CVSS: 6.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-51447 – Decidim vulnerable to cross-site scripting (XSS) in the dynamic file uploads
https://notcve.org/view.php?id=CVE-2023-51447
Decidim is a participatory democracy framework. Starting in version 0.27.0 and prior to versions 0.27.5 and 0.28.0, the dynamic file upload feature is subject to potential cross-site scripting attacks in case the attacker manages to modify the file names of the records being uploaded to the server. This appears in sections where the user controls the file upload dialogs themselves and has the technical knowledge to change the file names through the dynamic upload endpoint. Therefore I believe it would require the attacker to control the whole session of the particular user but in any case, this needs to be fixed. Successful exploit of this vulnerability would require the user to have successfully uploaded a file blob to the server with a malicious file name and then have the possibility to direct the other user to the edit page of the record where the attachment is attached. • https://github.com/decidim/decidim/commit/aaf72787cf18beeeb6a771c1f7cbb7654b073423 https://github.com/decidim/decidim/pull/11612 https://github.com/decidim/decidim/releases/tag/v0.27.5 https://github.com/decidim/decidim/releases/tag/v0.28.0 https://github.com/decidim/decidim/security/advisories/GHSA-9w99-78rj-hmxq https://github.com/rails/rails/blob/a967d355c6fee9ad9b8bd115d43bc8b0fc207e7e/activestorage/app/controllers/active_storage/direct_uploads_controller.rb#L14 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.7EPSS: 0%CPEs: 1EXPL: 0CVE-2023-48220 – Decidim's devise_invitable gem vulnerable to circumvention of invitation token expiry period
https://notcve.org/view.php?id=CVE-2023-48220
Decidim is a participatory democracy framework. Starting in version 0.4.rc3 and prior to version 2.0.9 of the `devise_invitable` gem, the invites feature allows users to accept the invitation for an unlimited amount of time through the password reset functionality. This issue creates vulnerable dependencies starting in version 0.0.1.alpha3 and prior to versions 0.26.9, 0.27.5, and 0.28.0 of the `decidim,` `decidim-admin`, and `decidim-system` gems. When using the password reset functionality, the `devise_invitable` gem always accepts the pending invitation if the user has been invited. The only check done is if the user has been invited but the code does not ensure that the pending invitation is still valid as defined by the `invite_for` expiry period. • https://github.com/decidim/decidim/blob/d2d390578050772d1bdb6d731395f1afc39dcbfc/decidim-core/config/initializers/devise.rb#L134 https://github.com/decidim/decidim/commit/073e60e2e4224dd81815a784002ebba30f2ebb34 https://github.com/decidim/decidim/commit/b12800717a689c295a9ea680a38ca9f823d2c454 https://github.com/decidim/decidim/releases/tag/v0.26.9 https://github.com/decidim/decidim/releases/tag/v0.27.5 https://github.com/decidim/decidim/releases/tag/v0.28.0 https://github.com/decidim/decidim/security/advisories/GHSA-w3q8 • CWE-672: Operation on a Resource after Expiration or Release •
CVSS: 4.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-47635 – Decidim vulnerable to possible CSRF attack at questionnaire templates preview
https://notcve.org/view.php?id=CVE-2023-47635
Decidim is a participatory democracy framework. Starting in version 0.23.0 and prior to versions 0.27.5 and 0.28.0, the CSRF authenticity token check is disabled for the questionnaire templates preview. The issue does not imply a serious security thread as you need to have access also to the session cookie in order to see this resource. This URL does not allow modifying the resource but it may allow attackers to gain access to information which was not meant to be public. The issue is fixed in version 0.27.5 and 0.28.0. • https://github.com/decidim/decidim/blob/3187bdfd40ea1c57c2c12512b09a7fec0b2bed08/decidim-templates/app/controllers/decidim/templates/admin/questionnaire_templates_controller.rb#L11 https://github.com/decidim/decidim/commit/5542227be66e3b6d7530f5b536069bce09376660 https://github.com/decidim/decidim/commit/57a4b467787448307b5d9b01ce6e2c8502e121ac https://github.com/decidim/decidim/pull/11743 https://github.com/decidim/decidim/pull/6247 https://github.com/decidim/decidim/releases/tag/v0.27.5 https://github.com/decidim/decidim/releases/tag& • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 3.1EPSS: 0%CPEs: 2EXPL: 0CVE-2023-47634 – Decidim has race condition in Endorsements
https://notcve.org/view.php?id=CVE-2023-47634
Decidim is a participatory democracy framework. Starting in version 0.10.0 and prior to versions 0.26.9, 0.27.5, and 0.28.0, a race condition in the endorsement of resources (for instance, a proposal) allows a user to make more than once endorsement. To exploit this vulnerability, the request to set an endorsement must be sent several times in parallel. Versions 0.26.9, 0.27.5, and 0.28.0 contain a patch for this issue. As a workaround, disable the Endorsement feature in the components. • https://github.com/decidim/decidim/releases/tag/v0.26.9 https://github.com/decidim/decidim/releases/tag/v0.27.5 https://github.com/decidim/decidim/releases/tag/v0.28.0 https://github.com/decidim/decidim/security/advisories/GHSA-r275-j57c-7mf2 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 9.1EPSS: 0%CPEs: 2EXPL: 0CVE-2023-36465 – Decidim has broken access control in templates
https://notcve.org/view.php?id=CVE-2023-36465
Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. The `templates` module doesn't enforce the correct permissions, allowing any logged-in user to access to this functionality in the administration panel. An attacker could use this vulnerability to change, create or delete templates of surveys. This issue has been patched in version 0.26.8 and 0.27.4. Decidim es un framework de democracia participativa, escrito en Ruby on Rails, desarrollado originalmente para el sitio web de participación en línea y fuera de línea del gobierno de la ciudad de Barcelona. • https://github.com/decidim/decidim/releases/tag/v0.26.8 https://github.com/decidim/decidim/releases/tag/v0.27.4 https://github.com/decidim/decidim/security/advisories/GHSA-639h-86hw-qcjq • CWE-284: Improper Access Control CWE-732: Incorrect Permission Assignment for Critical Resource •