~ / search / GHSA-r275-j57c-7mf2

GHSA-r275-j57c-7mf2

Race condition in Endorsements

Source: GitHub Advisory Database (reviewed) Low CVE-2023-47634

Packages

EcosystemPackageAffectedFixed in
RubyGems decidim >= 0.10.0, < 0.26.9 0.26.9
RubyGems decidim >= 0.27.0, < 0.27.5 0.27.5

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact A race condition in the endorsement of resources (for instance, a proposal) allows a user to make more than once endorsement. To exploit this vulnerability, the request to set an endorsement must be sent several times in parallel. ### Workarounds Disable the Endorsement feature in the components.

References

External links from the advisory. They lead to third-party sites.