Log in Start free

Vulnerability · Published Sep 16, 2024 · Assigned by GitHub_M

CVE-2024-32034Cross-site scripting (XSS) in the decidim admin activity log

Medium 6.8

In plain English

A medium-severity cross-site scripting in decidim from decidim. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.8Medium
Exploit odds (30 days)0.4%top 68.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

decidim is a Free Open-Source participatory democracy, citizen participation and open government for cities and organizations. The admin panel is subject to potential Cross-site scripting (XSS) attach in case an admin assigns a valuator to a proposal, or does any other action that generates an admin activity log where one of the resources has an XSS crafted. This issue has been addressed in release version 0.27.7, 0.28.2, and newer. Users are advised to upgrade. Users unable to upgrade may redirect the pages /admin and /admin/logs to other admin pages to prevent this access (i.e. `/admin/organization/edit`).

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
RubyGemsdecidim-admin0.27.7GHSA-rx9f-5ggv-5rh6
RubyGemsdecidim-admin0.28.2GHSA-rx9f-5ggv-5rh6

Affected products (as reported)

VendorProductVersions
decidim decidim < 0.27.7>= 0.28.0, < 0.28.2

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N

References