~ / search / GHSA-5652-92r9-3fx9

GHSA-5652-92r9-3fx9

Decidim Cross-site Scripting vulnerability in the processes filter

Source: GitHub Advisory Database (reviewed) High CVE-2023-34089

Packages

EcosystemPackageAffectedFixed in
RubyGems decidim >= 0.14.0, < 0.26.7 0.26.7
RubyGems decidim >= 0.27.0, < 0.27.3 0.27.3
RubyGems decidim-core >= 0.14.0, < 0.26.7 0.26.7
RubyGems decidim-core >= 0.27.0, < 0.27.3 0.27.3

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact The processes filter feature is susceptible to Cross-site scripting. This allows a remote attacker to execute JavaScript code in the context of a currently logged-in user. An attacker could use this vulnerability to make other users endorse or support proposals they have no intention of supporting or endorsing. ### Patches The problem was patched in [v0.27.3](https://github.com/decidim/decidim/releases/tag/v0.27.3) and [v0.26.7](https://github.com/decidim/decidim/releases/tag/v0.26.7)

References

External links from the advisory. They lead to third-party sites.