Headline
GHSA-qcj6-vxwx-4rqv: Decidim vulnerable to data disclosure through the embed feature
Impact
If an attacker can infer the slug or URL of an unpublished or private resource, and this resource can be embedded (such as a Participatory Process, an Assembly, a Proposal, a Result, etc), then some data of this resource could be accessed.
Patches
version 0.27.6
https://github.com/decidim/decidim/commit/1756fa639ef393ca8e8bb16221cab2e2e7875705
Workarounds
Disallow access through your web server to the URLs finished with /embed.html
Package
bundler decidim (RubyGems)
Affected versions
< 0.27.6
Patched versions
0.27.6
Description
Impact
If an attacker can infer the slug or URL of an unpublished or private resource, and this resource can be embedded (such as a Participatory Process, an Assembly, a Proposal, a Result, etc), then some data of this resource could be accessed.
Patches
version 0.27.6
decidim/decidim@1756fa6
Workarounds
Disallow access through your web server to the URLs finished with /embed.html
References
- GHSA-qcj6-vxwx-4rqv
- decidim/decidim#12528
- decidim/decidim@1756fa6
- https://github.com/decidim/decidim/releases/tag/v0.27.6
- https://nvd.nist.gov/vuln/detail/CVE-2024-27090
andreslucena published to decidim/decidim
Jul 10, 2024
Published to the GitHub Advisory Database
Jul 10, 2024
Reviewed
Jul 10, 2024
Published by the National Vulnerability Database
Jul 10, 2024
Last updated
Jul 10, 2024