CVE-2024-27095

Decidim is a participatory democracy framework. The admin panel is subject to potential XSS attach in case the attacker manages to modify some records being uploaded to the server. This vulnerability is fixed in 0.27.6 and 0.28.1.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
5.4 MEDIUM
NETWORK
HIGH
HIGH
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N
GitHub_MCNA
5.4 MEDIUM
NETWORK
HIGH
HIGH
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N
CISA-ADPADP
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 32%
VendorProductVersion
decidimdecidim
𝑥
< 0.27.6
decidimdecidim
0.28.0
decidimdecidim
0.28.0:rc1
decidimdecidim
0.28.0:rc2
decidimdecidim
0.28.0:rc3
decidimdecidim
0.28.0:rc4
decidimdecidim
0.28.0:rc5
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/decidim/decidim/releases/tag/v0.27.6
https://github.com/decidim/decidim/releases/tag/v0.28.1
https://github.com/decidim/decidim/security/advisories/GHSA-529p-jj47-w3m3
https://github.com/decidim/decidim/releases/tag/v0.27.6
https://github.com/decidim/decidim/releases/tag/v0.28.1
https://github.com/decidim/decidim/security/advisories/GHSA-529p-jj47-w3m3