PT-2023-24662 · Decidim · Decidim

Alonsorossi · Published 2023-07-11 · Updated 2023-07-21 · CVE-2023-34089

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Decidim versions prior to 0.26.7 Decidim versions prior to 0.27.3

Description The processes filter feature in Decidim is susceptible to Cross-site scripting, allowing a remote attacker to execute JavaScript code in the context of a currently logged-in user. This could be used to make other users endorse or support proposals they have no intention of supporting or endorsing.

Recommendations For versions prior to 0.26.7, update to version 0.26.7 to resolve the issue. For versions prior to 0.27.3, update to version 0.27.3 to resolve the issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-34089

GHSA-5652-92R9-3FX9

Affected Products

Decidim

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/34xxx/CVE-2023-34089.json · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim/CVE-2023-34089.yml · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim-core/CVE-2023-34089.yml · Exploit
• https://osv.dev/vulnerability/GHSA-5652-92r9-3fx9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-34089 · Security Note
• https://osv.dev/vulnerability/CVE-2023-34089 · Vendor Advisory
• https://github.com/decidim/decidim · Note
• https://github.com/decidim/decidim/releases/tag/v0.26.7 · Note
• https://github.com/decidim/decidim/releases/tag/v0.27.3 · Note
• https://github.com/decidim/decidim/security/advisories/GHSA-5652-92r9-3fx9 · Note
• https://github.com/decidim/decidim/releases/tag/v0.26.6 · Note
• https://t.me/cvenotify/54680 · Telegram Post
• https://t.me/cvenotify/54089 · Telegram Post