Security
Headlines
HeadlinesLatestCVEs

Headline

GHSA-qcj6-vxwx-4rqv: Decidim vulnerable to data disclosure through the embed feature

Impact

If an attacker can infer the slug or URL of an unpublished or private resource, and this resource can be embedded (such as a Participatory Process, an Assembly, a Proposal, a Result, etc), then some data of this resource could be accessed.

Patches

version 0.27.6

https://github.com/decidim/decidim/commit/1756fa639ef393ca8e8bb16221cab2e2e7875705

Workarounds

Disallow access through your web server to the URLs finished with /embed.html

ghsa
#vulnerability#web#git#ruby

Package

bundler decidim (RubyGems)

Affected versions

< 0.27.6

Patched versions

0.27.6

Description

Impact

If an attacker can infer the slug or URL of an unpublished or private resource, and this resource can be embedded (such as a Participatory Process, an Assembly, a Proposal, a Result, etc), then some data of this resource could be accessed.

Patches

version 0.27.6

decidim/decidim@1756fa6

Workarounds

Disallow access through your web server to the URLs finished with /embed.html

References

  • GHSA-qcj6-vxwx-4rqv
  • decidim/decidim#12528
  • decidim/decidim@1756fa6
  • https://github.com/decidim/decidim/releases/tag/v0.27.6
  • https://nvd.nist.gov/vuln/detail/CVE-2024-27090

andreslucena published to decidim/decidim

Jul 10, 2024

Published to the GitHub Advisory Database

Jul 10, 2024

Reviewed

Jul 10, 2024

Published by the National Vulnerability Database

Jul 10, 2024

Last updated

Jul 10, 2024

ghsa: Latest News

GHSA-27wf-5967-98gx: Kubernetes kubelet arbitrary command execution