PT-2024-13465 · Decidim · Decidim

Andreslucena · Published 2024-02-20 · Updated 2024-12-16 · CVE-2023-47635

Positive Technologies (AI Summary)

CVSS v3.1

5.7

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Decidim versions 0.23.0 through 0.27.4 Decidim versions 0.28.0 before the fix

Description Decidim is a participatory democracy framework. The CSRF authenticity token check is disabled for the questionnaire templates preview, which may allow attackers to gain access to information that was not meant to be public. This issue does not imply a serious security threat as access to the session cookie is also required to see this resource. The URL does not allow modifying the resource.

Recommendations For Decidim versions 0.23.0 through 0.27.4, update to version 0.27.5 or later. For Decidim versions 0.28.0 before the fix, update to the fixed version 0.28.0 or later. As a temporary workaround, consider disabling the templates functionality or removing all available templates to minimize the risk of exploitation.

Exploit

Fix

SSRF

CSRF

Weakness Enumeration

CWE-918

CWE-352

Related Identifiers

CVE-2023-47635

GHSA-F3QM-VFC3-JG6V

Affected Products

Decidim

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/47xxx/CVE-2023-47635.json · Exploit
• https://github.com/decidim/decidim/commit/5542227be66e3b6d7530f5b536069bce09376660 · Patch
• https://github.com/decidim/decidim/security/advisories/GHSA-f3qm-vfc3-jg6v · Vendor Advisory
• https://github.com/decidim/decidim/commit/57a4b467787448307b5d9b01ce6e2c8502e121ac · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-47635 · Security Note
• https://osv.dev/vulnerability/GHSA-f3qm-vfc3-jg6v · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-47635 · Vendor Advisory
• https://github.com/decidim/decidim · Note
• https://github.com/decidim/decidim/releases/tag/v0.28.0 · Note
• https://github.com/decidim/decidim/releases/tag/v0.27.5 · Note
• https://github.com/decidim/decidim/pull/6247 · Note
• https://github.com/decidim/decidim/blob/3187bdfd40ea1c57c2c12512b09a7fec0b2bed08/decidim-templates/app/controllers/decidim/templates/admin/questionnaire_templates_controller.rb#L11 · Note
• https://github.com/decidim/decidim/pull/11743 · Note
• https://twitter.com/CVEnew/status/1759984626570014803 · Twitter Post
• https://twitter.com/rubylandnews/status/1760414192048214341 · Twitter Post