PT-2023-23967 · Decidim · Decidim

P- · Published 2023-07-11 · Updated 2023-07-21 · CVE-2023-32693

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Decidim versions prior to 0.26.7 Decidim versions prior to 0.27.3

Description The external link feature in Decidim is susceptible to cross-site scripting, allowing a remote attacker to execute JavaScript code in the context of a currently logged-in user. This could be used to make other users endorse or support proposals they have no intention of supporting or endorsing.

Recommendations For versions prior to 0.26.7, update to version 0.26.7 or later. For versions prior to 0.27.3, update to version 0.27.3 or later. As a temporary workaround, consider restricting the use of the external link feature until a patch is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-32693

GHSA-469H-MQG8-535R

Affected Products

Decidim

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/32xxx/CVE-2023-32693.json · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim/CVE-2023-32693.yml · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim-core/CVE-2023-32693.yml · Exploit
• https://osv.dev/vulnerability/CVE-2023-32693 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-32693 · Security Note
• https://osv.dev/vulnerability/GHSA-469h-mqg8-535r · Vendor Advisory
• https://github.com/decidim/decidim · Note
• https://github.com/decidim/decidim/security/advisories/GHSA-469h-mqg8-535r · Note
• https://github.com/decidim/decidim/releases/tag/v0.26.7 · Note
• https://github.com/decidim/decidim/releases/tag/v0.27.3 · Note
• https://t.me/cibsecurity/66424 · Telegram Post
• https://t.me/cvenotify/54675 · Telegram Post