Vulnerability · Published Jul 11, 2023 · Assigned by GitHub_M
CVE-2023-34090Decidim vulnerable to sensitive data disclosure
High 7.5
In plain English
A high-severity information exposure in decidim from decidim. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 70% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. Decidim uses a third-party library named Ransack for filtering certain database collections (e.g., public meetings). By default, this library allows filtering on all data attributes and associations. This allows an unauthenticated remote attacker to exfiltrate non-public data from the underlying database of a Decidim instance (e.g., exfiltrating data from the user table). This issue may lead to Sensitive Data Disclosure. The problem was patched in version 0.27.3.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| RubyGems | decidim | 0.27.3 | GHSA-jm79-9pm4-vrw9 |
| RubyGems | decidim-meetings | 0.27.3 | GHSA-jm79-9pm4-vrw9 |
Affected products (as reported)
Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N