Version 0.21.0
decidim
The participatory democracy framework. A generator and multiple gems made with Ruby on Rails
Install Instructions
gem install decidim
Current Version Release Date October 02, 2024
Language Ruby
Package URL (purl) pkg:gem/decidim@0.21.0
Find decidim vulnerabilities in your supply chain.
decidim Vulnerabilities
Sort by
CVE (Latest)
CVE (Latest)
-
CVE (Latest)
-
CVE (Oldest)
-
CVSS Score (Highest)
-
CVSS Score (Lowest)
CVE  |
CVSS Score |
CWE(s) |
EPSS Score |
EPSS % |
Impacted Versions |
|---|---|---|---|---|---|
| CVE-2023-34089 | Medium 6.1 | CWE-79 | 0.00187 | 0.57199 |
|
| CVE-2023-47634 | Low 3.1 | CWE-362 | 0.00045 | 0.17206 |
|
| CVE-2023-48220 | Medium 5.7 | CWE-672 | 0.00044 | 0.14587 |
|
| CVE-2024-27090 | Medium 5.3 | CWE-200 | 0.00045 | 0.17206 |
|
| CVE-2024-32469 | High 7.1 | CWE-79 | 0.00045 | 0.17206 |
|
| CVE-2024-39910 | Medium 4.8 | CWE-79 | 0.00045 | 0.15514 |
|
| CVE-2024-41673 | High 7.1 | CWE-79 | 0.00043 | 0.10406 |
|
| CVE-2023-36465 | High 7.1 | CWE-284, CWE-732 | 0.00092 | 0.40954 |
|
| CVE-2023-32693 | Medium 6.1 | CWE-79 | 0.00187 | 0.57199 |
|
| CVE-2023-34090 | High 7.5 | CWE-200 | 0.00157 | 0.53228 |
|
| CVE-2023-51447 | Medium 6.3 | CWE-79 | 0.00044 | 0.11741 |
|
decidim Vulnerability Remediation Guidance
| CVE | Description | Full list of Impacted Versions | Fix |
|---|---|---|---|
| CVE-2024-41673 | Decidim is a participatory democracy framework. The version control feature used in resources is subject to potential XSS attack through a malformed URL. This vulnerability is fixed in 0.27.8. | 0.21.0, 0.6.5, 0.6.4, 0.6.7, 0.6.8, 0.7.1, 0.7.0, 0.7.2 (Show all) | Patch → NO_SAFE_VERSION |
| CVE-2024-39910 | decidim is a Free Open-Source participatory democracy, citizen participation and open government for cities and organizations. The WYSWYG editor QuillJS is subject to potential XSS attach in case the attacker manages to modify the HTML before being uploaded to the server. The attacker is able to change e.g. to <svg onload=alert('XSS')> if they know how to craft these requests themselves. This issue has been addressed in release version 0.27.7. All users are advised to upgrade. Users unable to upgrade should review the user accounts that have access to the admin panel (i.e. general Administrators, and participatory space's Administrators) and remove access to them if they don't need it. Disable the "Enable rich text editor for participants" setting in the admin dashboard | 0.21.0, 0.6.5, 0.6.4, 0.6.7, 0.6.8, 0.7.1, 0.7.0, 0.7.2 (Show all) | Patch → NO_SAFE_VERSION |
| CVE-2024-32469 | Decidim is a participatory democracy framework. The pagination feature used in searches and filters is subject to potential XSS attack through a malformed URL using the GET parameter `per_page`. This vulnerability is fixed in 0.27.6 and 0.28.1. | 0.21.0, 0.6.5, 0.6.4, 0.6.7, 0.6.8, 0.7.1, 0.7.0, 0.7.2 (Show all) | Patch → NO_SAFE_VERSION |
| CVE-2024-27090 | Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. If an attacker can infer the slug or URL of an unpublished or private resource, and this resource can be embbeded (such as a Participatory Process, an Assembly, a Proposal, a Result, etc), then some data of this resource could be accessed. This vulnerability is fixed in 0.27.6. | 0.21.0, 0.6.5, 0.6.4, 0.6.7, 0.6.8, 0.7.1, 0.7.0, 0.7.2 (Show all) | Patch → NO_SAFE_VERSION |
| CVE-2023-51447 | Decidim is a participatory democracy framework. Starting in version 0.27.0 and prior to versions 0.27.5 and 0.28.0, the dynamic file upload feature is subject to potential cross-site scripting attacks in case the attacker manages to modify the file names of the records being uploaded to the server. This appears in sections where the user controls the file upload dialogs themselves and has the technical knowledge to change the file names through the dynamic upload endpoint. Therefore I believe it would require the attacker to control the whole session of the particular user but in any case, this needs to be fixed. Successful exploit of this vulnerability would require the user to have successfully uploaded a file blob to the server with a malicious file name and then have the possibility to direct the other user to the edit page of the record where the attachment is attached. The users are able to craft the direct upload requests themselves controlling the file name that gets stored to the database. The attacker is able to change the filename e.g. to `<svg onload=alert('XSS')>` if they know how to craft these requests themselves. And then enter the returned blob ID to the form inputs manually by modifying the edit page source. Versions 0.27.5 and 0.28.0 contain a patch for this issue. As a workaround, disable dynamic uploads for the instance, e.g. from proposals. | 0.27.0 | Patch → NO_SAFE_VERSION |
| CVE-2023-48220 | Decidim is a participatory democracy framework. Starting in version 0.4.rc3 and prior to version 2.0.9 of the `devise_invitable` gem, the invites feature allows users to accept the invitation for an unlimited amount of time through the password reset functionality. This issue creates vulnerable dependencies starting in version 0.0.1.alpha3 and prior to versions 0.26.9, 0.27.5, and 0.28.0 of the `decidim,` `decidim-admin`, and `decidim-system` gems. When using the password reset functionality, the `devise_invitable` gem always accepts the pending invitation if the user has been invited. The only check done is if the user has been invited but the code does not ensure that the pending invitation is still valid as defined by the `invite_for` expiry period. Decidim sets this configuration to `2.weeks` so this configuration should be respected. The bug is in the `devise_invitable` gem and should be fixed there and the dependency should be upgraded in Decidim once the fix becomes available. `devise_invitable` to version `2.0.9` and above fix this issue. Versions 0.26.9, 0.27.5, and 0.28.0 of the `decidim,` `decidim-admin`, and `decidim-system` gems contain this fix. As a workaround, invitations can be cancelled directly from the database. | 0.21.0, 0.6.5, 0.6.4, 0.6.7, 0.6.8, 0.7.1, 0.7.0, 0.7.2 (Show all) | Patch → NO_SAFE_VERSION |
| CVE-2023-47634 | Decidim is a participatory democracy framework. Starting in version 0.10.0 and prior to versions 0.26.9, 0.27.5, and 0.28.0, a race condition in the endorsement of resources (for instance, a proposal) allows a user to make more than once endorsement. To exploit this vulnerability, the request to set an endorsement must be sent several times in parallel. Versions 0.26.9, 0.27.5, and 0.28.0 contain a patch for this issue. As a workaround, disable the Endorsement feature in the components. | 0.21.0, 0.10.0, 0.10.1, 0.11.0.pre1, 0.14.3, 0.11.1, 0.12.0, 0.12.0.pre (Show all) | Patch → NO_SAFE_VERSION |
| CVE-2023-36465 | Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. The `templates` module doesn't enforce the correct permissions, allowing any logged-in user to access to this functionality in the administration panel. An attacker could use this vulnerability to change, create or delete templates of surveys. This issue has been patched in version 0.26.8 and 0.27.4. | 0.23.3, 0.23.4, 0.24.0.rc1, 0.26.2, 0.24.0, 0.24.3, 0.25.0.rc1, 0.25.0.rc2 (Show all) | Patch → NO_SAFE_VERSION |
| CVE-2023-34090 | Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. Decidim uses a third-party library named Ransack for filtering certain database collections (e.g., public meetings). By default, this library allows filtering on all data attributes and associations. This allows an unauthenticated remote attacker to exfiltrate non-public data from the underlying database of a Decidim instance (e.g., exfiltrating data from the user table). This issue may lead to Sensitive Data Disclosure. The problem was patched in version 0.27.3. | 0.27.0 | Patch → NO_SAFE_VERSION |
| CVE-2023-34089 | Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. The processes filter feature is susceptible to Cross-site scripting. This allows a remote attacker to execute JavaScript code in the context of a currently logged-in user. An attacker could use this vulnerability to make other users endorse or support proposals they have no intention of supporting or endorsing. The problem was patched in version 0.27.3 and 0.26.7. | 0.21.0, 0.14.3, 0.14.1, 0.14.4, 0.15.0, 0.15.1, 0.15.2, 0.16.0 (Show all) | Patch → NO_SAFE_VERSION |
| CVE-2023-32693 | Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. The external link feature is susceptible to cross-site scripting. This allows a remote attacker to execute JavaScript code in the context of a currently logged-in user. An attacker could use this vulnerability to make other users endorse or support proposals they have no intention of supporting or endorsing. The problem was patched in versions 0.27.3 and 0.26.7. | 0.26.2, 0.25.0, 0.25.1, 0.25.2, 0.26.0.rc2, 0.26.0, 0.26.1, 0.26.3 (Show all) | Patch → NO_SAFE_VERSION |
Instantly see if these decidim vulnerabilities affect your code.
Dependencies
Packages using versions of decidim affected by its vulnerabilities
| Dependent Packages |
|---|
| decidim-accountability= 0.29.1 |
| decidim-admin= 0.29.1 |
| decidim-api= 0.29.1 |
| decidim-assemblies= 0.29.1 |
| decidim-blogs= 0.29.1 |
| decidim-budgets= 0.29.1 |
| decidim-comments= 0.29.1 |
| decidim-core= 0.29.1 |
| decidim-debates= 0.29.1 |
| decidim-forms= 0.29.1 |
| decidim-generators= 0.29.1 |
| decidim-meetings= 0.29.1 |
| decidim-pages= 0.29.1 |
| decidim-participatory_processes= 0.29.1 |
| decidim-proposals= 0.29.1 |
| decidim-sortitions= 0.29.1 |
| decidim-surveys= 0.29.1 |
| decidim-system= 0.29.1 |
| decidim-verifications= 0.29.1 |