Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2023-34089

Good to know:

icon

Date: July 11, 2023

Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. The processes filter feature is susceptible to Cross-site scripting. This allows a remote attacker to execute JavaScript code in the context of a currently logged-in user. An attacker could use this vulnerability to make other users endorse or support proposals they have no intention of supporting or endorsing. The problem was patched in version 0.27.3 and 0.26.7.

Language: Ruby

Severity Score

Related Resources (9)

https://github.com/decidim/decidim/releases/tag/v0.26.6
https://github.com/decidim/decidim/releases/tag/v0.26.7
https://github.com/decidim/decidim/releases/tag/v0.27.3
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim/CVE-2023-34089.yml
https://github.com/decidim/decidim
https://nvd.nist.gov/vuln/detail/CVE-2023-34089
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim-core/CVE-2023-34089.yml
https://github.com/decidim/decidim/security/advisories/GHSA-5652-92r9-3fx9
https://www.mend.io/vulnerability-database/CVE-2023-34089

Severity Score

Weakness Type (CWE)

Cross-Site Scripting (XSS)

CWE-79

Top Fix

icon

Upgrade Version

Upgrade to version decidim - 0.26.6,0.27.3;decidim-core - 0.26.6,0.27.3

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): REQUIRED
Scope (S): UNCHANGED
Confidentiality (C): HIGH
Integrity (I): HIGH
Availability (A): NONE

Do you need more information?

Contact Us