CVE-2024-27095

Опубликовано: 10 июл. 2024

Источник: nvd

CVSS3: 5.4

CVSS3: 4.8

EPSS Низкий

Описание

Decidim is a participatory democracy framework. The admin panel is subject to potential XSS attach in case the attacker manages to modify some records being uploaded to the server. This vulnerability is fixed in 0.27.6 and 0.28.1.

Ссылки

https://github.com/decidim/decidim/releases/tag/v0.27.6
Release Notes
https://github.com/decidim/decidim/releases/tag/v0.28.1
Release Notes
https://github.com/decidim/decidim/security/advisories/GHSA-529p-jj47-w3m3
Third Party Advisory
https://github.com/decidim/decidim/releases/tag/v0.27.6
Release Notes
https://github.com/decidim/decidim/releases/tag/v0.28.1
Release Notes
https://github.com/decidim/decidim/security/advisories/GHSA-529p-jj47-w3m3
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:decidim:decidim:*:*:*:*:*:ruby:*:*

Версия до 0.27.6 (исключая)

cpe:2.3:a:decidim:decidim:0.28.0:-:*:*:*:ruby:*:*

cpe:2.3:a:decidim:decidim:0.28.0:rc1:*:*:*:ruby:*:*

cpe:2.3:a:decidim:decidim:0.28.0:rc2:*:*:*:ruby:*:*

cpe:2.3:a:decidim:decidim:0.28.0:rc3:*:*:*:ruby:*:*

cpe:2.3:a:decidim:decidim:0.28.0:rc4:*:*:*:ruby:*:*

cpe:2.3:a:decidim:decidim:0.28.0:rc5:*:*:*:ruby:*:*

EPSS

Процентиль: 51%

0.0028

Низкий

5.4 Medium

CVSS3

4.8 Medium

CVSS3

Дефекты

CWE-79

Связанные уязвимости

GHSA-529p-jj47-w3m3

CVSS3: 5.4

github

больше 1 года назад

Decidim cross-site scripting (XSS) in the admin panel

EPSS

Процентиль: 51%

0.0028

Низкий

5.4 Medium

CVSS3

4.8 Medium

CVSS3

Дефекты

CWE-79