PT-2024-24596 · Decidim · Decidim

Patrick Himler · Published 2024-07-10 · Updated 2024-07-11 · CVE-2024-32469

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Decidim versions prior to 0.27.6 Decidim versions prior to 0.28.1

Description The pagination feature used in searches and filters is subject to potential XSS attack through a malformed URL using the GET parameter per page. This issue was discovered in a security audit organized by the mitgestalten Partizipationsbüro and funded by netidee against Decidim done during April 2024.

Recommendations For Decidim versions prior to 0.27.6, update to version 0.27.6 or later to fix the vulnerability. For Decidim versions prior to 0.28.1, update to version 0.28.1 or later to fix the vulnerability. As a temporary workaround, consider restricting access to the per page parameter in the affected API endpoint until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-32469

GHSA-7CX8-44PC-XV3Q

Affected Products

Decidim

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/32xxx/CVE-2024-32469.json · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim/CVE-2024-32469.yml · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-32469 · Security Note
• https://osv.dev/vulnerability/CVE-2024-32469 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7cx8-44pc-xv3q · Vendor Advisory
• https://github.com/decidim/decidim · Note
• https://github.com/decidim/decidim/security/advisories/GHSA-7cx8-44pc-xv3q · Note
• https://github.com/decidim/decidim/releases/tag/v0.27.6 · Note
• https://github.com/decidim/decidim/releases/tag/v0.28.1 · Note
• https://twitter.com/CVEnew/status/1811322703418445824 · Twitter Post
• https://t.me/cvenotify/85713 · Telegram Post
• https://twitter.com/rubylandnews/status/1811510893382869447 · Twitter Post
• https://twitter.com/it_malibu/status/1811513434544243144 · Twitter Post
• https://t.me/cvedetector/580 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1811135633433202803 · Twitter Post