GitHub Advisoryadvisory · RubyGems

GHSA-639h-86hw-qcjq Decidim has broken access control in templates

HIGH Published 2023-10-05 Modified 2023-10-13 Official page ↗
Aliases
CVE-2023-36465
Ecosystem
RubyGems
Packages
decidim, decidim-templates
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Weaknesses
CWE-284, CWE-732
Reviewed
2023-10-05

Affected packages

• RubyGems decidim: >= 0.23.2, < 0.26.8 → fixed in 0.26.8 • RubyGems decidim-templates: >= 0.23.2, < 0.26.8 → fixed in 0.26.8 • RubyGems decidim-templates: >= 0.27.0, < 0.27.4 → fixed in 0.27.4 • RubyGems decidim: >= 0.27.0, < 0.27.4 → fixed in 0.27.4

Description

Impact The `templates` module doesn't enforce the correct permissions, allowing any logged-in user to access to this functionality in the administration panel. An attacker could use this vulnerability to change, create or delete templates of surveys.

Related

Alias · CVE (1)

  • CVE-2023-36465 Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and… vulnerability

Weakness · CWE (2)

  • CWE-284 Improper Access Control weakness
  • CWE-732 Incorrect Permission Assignment for Critical Resource weakness

References