CVE-2024-32469 | THREATINT

Description

Decidim is a participatory democracy framework. The pagination feature used in searches and filters is subject to potential XSS attack through a malformed URL using the GET parameter `per_page`. This vulnerability is fixed in 0.27.6 and 0.28.1.

Reserved 2024-04-12 | Published 2024-07-10 | Updated 2024-08-02 | Assigner GitHub_M

HIGH: 7.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

Problem types

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Product status

< 0.27.6

affected

>= 0.28.0.rc1, < 0.28.1

affected

References

github.com/...ecidim/security/advisories/GHSA-7cx8-44pc-xv3q

github.com/decidim/decidim/releases/tag/v0.27.6

github.com/decidim/decidim/releases/tag/v0.28.1

cve.org (CVE-2024-32469)

nvd.nist.gov (CVE-2024-32469)

Download JSON