PT-2024-28727 · Quilljs+1 · Quilljs+1

Andreslucena · Published 2024-09-16 · Updated 2024-09-29 · CVE-2024-39910

Positive Technologies (AI Summary)

CVSS v4.0

5.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions decidim versions prior to 0.27.7

Description The WYSWYG editor QuillJS in decidim is subject to potential XSS attacks if an attacker manages to modify the HTML before it is uploaded to the server. The attacker can change code, for example, to <svg onload=alert('XSS')> if they know how to craft these requests themselves.

Recommendations For versions prior to 0.27.7, upgrade to version 0.27.7. As a temporary workaround for users unable to upgrade, review the user accounts that have access to the admin panel and remove access to them if they don't need it. Disable the "Enable rich text editor for participants" setting in the admin dashboard.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-39910

GHSA-VVQW-FQWX-MQMM

Affected Products

Quilljs

Decidim

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/39xxx/CVE-2024-39910.json · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim/CVE-2024-39910.yml · Exploit
• https://github.com/decidim/decidim/commit/47adca81cabea898005ec07b130b008f2a2be99f · Patch
• https://github.com/decidim/decidim/security/advisories/GHSA-vvqw-fqwx-mqmm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-39910 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-39910 · Security Note
• https://osv.dev/vulnerability/GHSA-vvqw-fqwx-mqmm · Vendor Advisory
• https://github.com/decidim/decidim · Note
• https://t.me/cvedetector/5757 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1835779588212826562 · Twitter Post
• https://twitter.com/CVEnew/status/1835758860935594030 · Twitter Post