GHSA-639h-86hw-qcjq
Suggest an improvement- Source
- https://github.com/advisories/GHSA-639h-86hw-qcjq
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-639h-86hw-qcjq/GHSA-639h-86hw-qcjq.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-639h-86hw-qcjq
- Aliases
- Published
- 2023-10-05T20:52:46Z
- Modified
- 2024-02-16T08:10:26.277696Z
- Severity
-
- 7.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L CVSS Calculator
- Summary
- Decidim has broken access control in templates
- Details
-
Impact
The
templatesmodule doesn't enforce the correct permissions, allowing any logged-in user to access to this functionality in the administration panel. An attacker could use this vulnerability to change, create or delete templates of surveys. - Database specific
{ "github_reviewed": true, "cwe_ids": [ "CWE-284", "CWE-732" ], "github_reviewed_at": "2023-10-05T20:52:46Z", "nvd_published_at": "2023-10-06T12:15:11Z", "severity": "HIGH" }- References
-
- https://github.com/decidim/decidim/security/advisories/GHSA-639h-86hw-qcjq
- https://nvd.nist.gov/vuln/detail/CVE-2023-36465
- https://github.com/decidim/decidim
- https://github.com/decidim/decidim/releases/tag/v0.26.8
- https://github.com/decidim/decidim/releases/tag/v0.27.4
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim-templates/CVE-2023-36465.yml
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim/CVE-2023-36465.yml
Affected packages
RubyGems / decidim
Package
- Name
- decidim
- Purl
- pkg:gem/decidim
RubyGems / decidim-templates
Package
- Name
- decidim-templates
- Purl
- pkg:gem/decidim-templates
RubyGems / decidim-templates
Package
- Name
- decidim-templates
- Purl
- pkg:gem/decidim-templates
RubyGems / decidim
Package
- Name
- decidim
- Purl
- pkg:gem/decidim