~ / search / GHSA-qcj6-vxwx-4rqv

GHSA-qcj6-vxwx-4rqv

Decidim vulnerable to data disclosure through the embed feature

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-27090

Packages

EcosystemPackageAffectedFixed in
RubyGems decidim < 0.27.6 0.27.6

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact If an attacker can infer the slug or URL of an unpublished or private resource, and this resource can be embedded (such as a Participatory Process, an Assembly, a Proposal, a Result, etc), then some data of this resource could be accessed. ### Patches version 0.27.6 https://github.com/decidim/decidim/commit/1756fa639ef393ca8e8bb16221cab2e2e7875705 ### Workarounds Disallow access through your web server to the URLs finished with `/embed.html`

References

External links from the advisory. They lead to third-party sites.