GitHub Advisoryadvisory · RubyGems
GHSA-7cx8-44pc-xv3q Decidim cross-site scripting (XSS) in the pagination
MEDIUM
Official page ↗
- Aliases
- CVE-2024-32469
- Ecosystem
- RubyGems
- Packages
- decidim
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
- Weaknesses
- CWE-79
- Reviewed
- 2024-07-10
Affected packages
• RubyGems decidim: < 0.27.6 → fixed in 0.27.6
• RubyGems decidim: >= 0.28.0.rc1, < 0.28.1 → fixed in 0.28.1
Description
Impact
The pagination feature used in searches and filters is subject to potential XSS attack through a malformed URL using the GET parameter `per_page`.
Patches
Not available
Workarounds
Not available
References
OWASP ASVS v4.0.3-5.1.3
Credits
This issue was discovered in a security audit organized by the mitgestalten Partizipationsbüro and funded by netidee against Decidim done during April 2024. The security audit was implemented by AIT Austrian Institute of Technology GmbH,
Related
Alias · CVE (1)
- CVE-2024-32469 Decidim is a participatory democracy framework. vulnerability
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://github.com/decidim/decidim/security/advisories/GHSA-7cx8-44pc-xv3q web
- https://nvd.nist.gov/vuln/detail/CVE-2024-32469 advisory
- https://github.com/decidim/decidim package
- https://github.com/decidim/decidim/releases/tag/v0.27.6 web
- https://github.com/decidim/decidim/releases/tag/v0.28.1 web
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim/CVE-2024-32469.yml web