CVE-2025-65017

Опубликовано: 03 фев. 2026

Источник: nvd

CVSS3: 6.5

EPSS Низкий

Описание

Decidim is a participatory democracy framework. In versions from 0.30.0 to before 0.30.4 and from 0.31.0.rc1 to before 0.31.0, the private data exports can lead to data leaks in case the UUID generation, causing collisions for the generated UUIDs. This issue has been patched in versions 0.30.4 and 0.31.0.

Ссылки

https://github.com/decidim/decidim/pull/13571
Issue Tracking
Patch
https://github.com/decidim/decidim/releases/tag/v0.30.4
Release Notes
https://github.com/decidim/decidim/releases/tag/v0.31.0
Release Notes
https://github.com/decidim/decidim/security/advisories/GHSA-3cx6-j9j4-54mp
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:decidim:decidim:*:*:*:*:*:ruby:*:*

Версия от 0.30.0 (включая) до 0.30.4 (исключая)

cpe:2.3:a:decidim:decidim:0.31.0:rc1:*:*:*:ruby:*:*

cpe:2.3:a:decidim:decidim:0.31.0:rc2:*:*:*:ruby:*:*

EPSS

Процентиль: 18%

0.00262

Низкий

6.5 Medium

CVSS3

Дефекты

CWE-200

Связанные уязвимости

GHSA-3cx6-j9j4-54mp

github

7 месяцев назад

Decidim's private data exports can lead to data leaks