~ / search / GHSA-7cx8-44pc-xv3q

GHSA-7cx8-44pc-xv3q

Decidim cross-site scripting (XSS) in the pagination

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-32469

Packages

EcosystemPackageAffectedFixed in
RubyGems decidim < 0.27.6 0.27.6
RubyGems decidim >= 0.28.0.rc1, < 0.28.1 0.28.1

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact The pagination feature used in searches and filters is subject to potential XSS attack through a malformed URL using the GET parameter `per_page`. ### Patches Not available ### Workarounds Not available ### References OWASP ASVS v4.0.3-5.1.3 ### Credits This issue was discovered in a security audit organized by the [mitgestalten Partizipationsbüro](https://partizipationsbuero.at/) and funded by [netidee](https://www.netidee.at/) against Decidim done during April 2024. The security audit was implemented by [AIT Austrian Institute of Technology GmbH](https://www.ait.ac.at/),

References

External links from the advisory. They lead to third-party sites.