PT-2023-25580 · Decidim · Decidim
Andreslucena
·
Published
2023-10-05
·
Updated
2023-10-11
·
CVE-2023-36465
CVSS v3.1
9.1
Critical
| Vector | AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L |
Name of the Vulnerable Software and Affected Versions
Decidim versions prior to 0.26.8
Decidim versions prior to 0.27.4
Description
Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. The
templates module doesn't enforce the correct permissions, allowing any logged-in user to access this functionality in the administration panel. An attacker could use this issue to change, create, or delete templates of surveys.Recommendations
For Decidim versions prior to 0.26.8, update to version 0.26.8 or later to resolve the issue.
For Decidim versions prior to 0.27.4, update to version 0.27.4 or later to resolve the issue.
As a temporary workaround, consider restricting access to the
templates module in the administration panel to minimize the risk of exploitation.Exploit
Fix
Improper Access Control
Incorrect Permission
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Decidim