PT-2023-24662 · Decidim · Decidim

Alonsorossi · Publicado 2023-07-11 · Atualizado 2023-07-21 · CVE-2023-34089

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Decidim versions prior to 0.26.7 Decidim versions prior to 0.27.3

Description The processes filter feature in Decidim is susceptible to Cross-site scripting, allowing a remote attacker to execute JavaScript code in the context of a currently logged-in user. This could be used to make other users endorse or support proposals they have no intention of supporting or endorsing.

Recommendations For versions prior to 0.26.7, update to version 0.26.7 to resolve the issue. For versions prior to 0.27.3, update to version 0.27.3 to resolve the issue.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-34089

GHSA-5652-92R9-3FX9

Produtos afetados

Decidim

Referências · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/34xxx/CVE-2023-34089.json · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim/CVE-2023-34089.yml · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim-core/CVE-2023-34089.yml · Exploit
• https://github.com/decidim/decidim · Nota
• https://github.com/decidim/decidim/releases/tag/v0.26.7 · Nota
• https://github.com/decidim/decidim/releases/tag/v0.27.3 · Nota
• https://github.com/decidim/decidim/security/advisories/GHSA-5652-92r9-3fx9 · Nota
• https://github.com/decidim/decidim/releases/tag/v0.26.6 · Nota
• https://t.me/cvenotify/54680 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-5652-92r9-3fx9 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-34089 · Nota de Segurança
• https://t.me/cvenotify/54089 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-34089 · Aviso do Fabricante