Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1xY2o2LXZ4d3gtNHJxds4AA9wt

Decidim vulnerable to data disclosure through the embed feature

Impact

If an attacker can infer the slug or URL of an unpublished or private resource, and this resource can be embedded (such as a Participatory Process, an Assembly, a Proposal, a Result, etc), then some data of this resource could be accessed.

Patches

version 0.27.6

https://github.com/decidim/decidim/commit/1756fa639ef393ca8e8bb16221cab2e2e7875705

Workarounds

Disallow access through your web server to the URLs finished with /embed.html

Permalink: https://github.com/advisories/GHSA-qcj6-vxwx-4rqv
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1xY2o2LXZ4d3gtNHJxds4AA9wt
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: 6 months ago
Updated: 6 months ago

CVSS Score: 5.3
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS Percentage: 0.00045
EPSS Percentile: 0.17541

Identifiers: GHSA-qcj6-vxwx-4rqv, CVE-2024-27090
References:

• https://github.com/decidim/decidim/security/advisories/GHSA-qcj6-vxwx-4rqv
• https://github.com/decidim/decidim/pull/12528
• https://github.com/decidim/decidim/commit/1756fa639ef393ca8e8bb16221cab2e2e7875705
• https://github.com/decidim/decidim/releases/tag/v0.27.6
• https://nvd.nist.gov/vuln/detail/CVE-2024-27090
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim/CVE-2024-27090.yml
• https://github.com/advisories/GHSA-qcj6-vxwx-4rqv

Repository: https://github.com/decidim/decidim
Blast Radius: 13.2

Affected Packages