PT-2023-25580 · Decidim · Decidim
Andreslucena
·
Publicado
2023-10-05
·
Atualizado
2023-10-11
·
CVE-2023-36465
CVSS v3.1
9.1
Crítica
| Vetor | AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L |
Name of the Vulnerable Software and Affected Versions
Decidim versions prior to 0.26.8
Decidim versions prior to 0.27.4
Description
Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. The
templates module doesn't enforce the correct permissions, allowing any logged-in user to access this functionality in the administration panel. An attacker could use this issue to change, create, or delete templates of surveys.Recommendations
For Decidim versions prior to 0.26.8, update to version 0.26.8 or later to resolve the issue.
For Decidim versions prior to 0.27.4, update to version 0.27.4 or later to resolve the issue.
As a temporary workaround, consider restricting access to the
templates module in the administration panel to minimize the risk of exploitation.Exploit
Correção
Improper Access Control
Incorrect Permission
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Decidim