CVE-2024-27095.yml

---
gem: decidim-admin
cve: 2024-27095
ghsa: 529p-jj47-w3m3
url: https://github.com/decidim/decidim/security/advisories/GHSA-529p-jj47-w3m3
title: Decidim cross-site scripting (XSS) in the admin panel
date: 2024-07-10
description: |
  ### Impact

  The admin panel is subject to potential XSS attach in case the attacker
  manages to modify some records being uploaded to the server.

  The attacker is able to change  e.g. to `<svg onload=alert('XSS')>`
  if they know how to craft these requests themselves. And then enter
  the returned blob ID to the form inputs manually by modifying the
  edit page source.

  ### Patches

  Available in versions 0.27.6 and 0.28.1.

  ### Workarounds

  Review the user accounts that have access to the admin panel (i.e.
  general Administrators, and participatory space's Administrators)
  and remove access to them if they don't need it.

  ### References

  OWASP ASVS v4.0.3-5.1.3
cvss_v3: 5.4
patched_versions:
  - "~> 0.27.6"
  - ">= 0.28.1"
related:
  url:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-27095
    - https://github.com/decidim/decidim/security/advisories/GHSA-529p-jj47-w3m3
    - https://github.com/decidim/decidim/releases/tag/v0.27.6
    - https://github.com/decidim/decidim/releases/tag/v0.28.1
    - https://github.com/advisories/GHSA-529p-jj47-w3m3