{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-32034", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-04-09T15:29:35.939Z", "datePublished": "2024-09-16T18:38:09.562Z", "dateUpdated": "2024-09-16T20:00:04.199Z"}, "containers": {"cna": {"title": "Cross-site scripting (XSS) in the decidim admin activity log", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/decidim/decidim/security/advisories/GHSA-rx9f-5ggv-5rh6", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/decidim/decidim/security/advisories/GHSA-rx9f-5ggv-5rh6"}, {"name": "https://github.com/decidim/decidim/commit/23fc8d702a4976727f78617f5e42353d67931645", "tags": ["x_refsource_MISC"], "url": "https://github.com/decidim/decidim/commit/23fc8d702a4976727f78617f5e42353d67931645"}, {"name": "https://github.com/decidim/decidim/commit/9d79f09a2d38c87feb28725670d6cc1f55c22072", "tags": ["x_refsource_MISC"], "url": "https://github.com/decidim/decidim/commit/9d79f09a2d38c87feb28725670d6cc1f55c22072"}, {"name": "https://github.com/decidim/decidim/commit/e494235d559be13dd1f8694345e6f6bba762d1c0", "tags": ["x_refsource_MISC"], "url": "https://github.com/decidim/decidim/commit/e494235d559be13dd1f8694345e6f6bba762d1c0"}, {"name": "https://github.com/decidim/decidim/commit/ff755e23814aeb56e9089fc08006a5d3faee47b6", "tags": ["x_refsource_MISC"], "url": "https://github.com/decidim/decidim/commit/ff755e23814aeb56e9089fc08006a5d3faee47b6"}], "affected": [{"vendor": "decidim", "product": "decidim", "versions": [{"version": "< 0.27.7", "status": "affected"}, {"version": ">= 0.28.0, < 0.28.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-09-16T18:38:09.562Z"}, "descriptions": [{"lang": "en", "value": "decidim is a Free Open-Source participatory democracy, citizen participation and open government for cities and organizations. The admin panel is subject to potential Cross-site scripting (XSS) attach in case an admin assigns a valuator to a proposal, or does any other action that generates an admin activity log where one of the resources has an XSS crafted. This issue has been addressed in release version 0.27.7, 0.28.2, and newer. Users are advised to upgrade. Users unable to upgrade may redirect the pages /admin and /admin/logs to other admin pages to prevent this access (i.e. `/admin/organization/edit`)."}], "source": {"advisory": "GHSA-rx9f-5ggv-5rh6", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-09-16T19:59:49.091452Z", "id": "CVE-2024-32034", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-16T20:00:04.199Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-32034", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-16T19:59:49.091452Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-16T19:59:58.775Z"}}], "cna": {"title": "Cross-site scripting (XSS) in the decidim admin activity log", "source": {"advisory": "GHSA-rx9f-5ggv-5rh6", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "decidim", "product": "decidim", "versions": [{"status": "affected", "version": "< 0.27.7"}, {"status": "affected", "version": ">= 0.28.0, < 0.28.2"}]}], "references": [{"url": "https://github.com/decidim/decidim/security/advisories/GHSA-rx9f-5ggv-5rh6", "name": "https://github.com/decidim/decidim/security/advisories/GHSA-rx9f-5ggv-5rh6", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/decidim/decidim/commit/23fc8d702a4976727f78617f5e42353d67931645", "name": "https://github.com/decidim/decidim/commit/23fc8d702a4976727f78617f5e42353d67931645", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/decidim/decidim/commit/9d79f09a2d38c87feb28725670d6cc1f55c22072", "name": "https://github.com/decidim/decidim/commit/9d79f09a2d38c87feb28725670d6cc1f55c22072", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/decidim/decidim/commit/e494235d559be13dd1f8694345e6f6bba762d1c0", "name": "https://github.com/decidim/decidim/commit/e494235d559be13dd1f8694345e6f6bba762d1c0", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/decidim/decidim/commit/ff755e23814aeb56e9089fc08006a5d3faee47b6", "name": "https://github.com/decidim/decidim/commit/ff755e23814aeb56e9089fc08006a5d3faee47b6", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "decidim is a Free Open-Source participatory democracy, citizen participation and open government for cities and organizations. The admin panel is subject to potential Cross-site scripting (XSS) attach in case an admin assigns a valuator to a proposal, or does any other action that generates an admin activity log where one of the resources has an XSS crafted. This issue has been addressed in release version 0.27.7, 0.28.2, and newer. Users are advised to upgrade. Users unable to upgrade may redirect the pages /admin and /admin/logs to other admin pages to prevent this access (i.e. `/admin/organization/edit`)."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-09-16T18:38:09.562Z"}}}, "cveMetadata": {"cveId": "CVE-2024-32034", "state": "PUBLISHED", "dateUpdated": "2024-09-16T20:00:04.199Z", "dateReserved": "2024-04-09T15:29:35.939Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2024-09-16T18:38:09.562Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:decidim:decidim:*:*:*:*:*:ruby:*:*", "matchCriteriaId": "6C6546E7-9340-4C15-BEF9-9075508E1C35", "versionEndExcluding": "0.27.7", "vulnerable": true}, {"criteria": "cpe:2.3:a:decidim:decidim:0.28.0:-:*:*:*:ruby:*:*", "matchCriteriaId": "637B8863-0862-4FB4-9871-EDCF21054F34", "vulnerable": true}, {"criteria": "cpe:2.3:a:decidim:decidim:0.28.1:*:*:*:*:ruby:*:*", "matchCriteriaId": "45B74421-A9CA-4C0F-86ED-A6AAB5FCF7F7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "decidim is a Free Open-Source participatory democracy, citizen participation and open government for cities and organizations. The admin panel is subject to potential Cross-site scripting (XSS) attach in case an admin assigns a valuator to a proposal, or does any other action that generates an admin activity log where one of the resources has an XSS crafted. This issue has been addressed in release version 0.27.7, 0.28.2, and newer. Users are advised to upgrade. Users unable to upgrade may redirect the pages /admin and /admin/logs to other admin pages to prevent this access (i.e. `/admin/organization/edit`)."}, {"lang": "es", "value": "Decidim es una democracia participativa, participaci\u00f3n ciudadana y gobierno abierto de c\u00f3digo abierto y gratuito para ciudades y organizaciones. El panel de administraci\u00f3n est\u00e1 sujeto a posibles ataques de cross site scripting (XSS) en caso de que un administrador asigne un evaluador a una propuesta o realice cualquier otra acci\u00f3n que genere un registro de actividad de administraci\u00f3n donde uno de los recursos tenga un XSS creado. Este problema se ha solucionado en las versiones de lanzamiento 0.27.7, 0.28.2 y posteriores. Se recomienda a los usuarios que actualicen. Los usuarios que no puedan actualizar pueden redirigir las p\u00e1ginas /admin y /admin/logs a otras p\u00e1ginas de administraci\u00f3n para evitar este acceso (es decir, `/admin/organization/edit`)."}], "id": "CVE-2024-32034", "lastModified": "2024-09-29T00:14:35.067", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.7, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 4.0, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2024-09-16T19:16:10.300", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/decidim/decidim/commit/23fc8d702a4976727f78617f5e42353d67931645"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/decidim/decidim/commit/9d79f09a2d38c87feb28725670d6cc1f55c22072"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/decidim/decidim/commit/e494235d559be13dd1f8694345e6f6bba762d1c0"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/decidim/decidim/commit/ff755e23814aeb56e9089fc08006a5d3faee47b6"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/decidim/decidim/security/advisories/GHSA-rx9f-5ggv-5rh6"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{}