Moderate severityNVD Advisory· Published Nov 13, 2024· Updated Nov 13, 2024
Decidim allows cross-site scripting (XSS) in the online or hybrid meeting embeds
CVE-2024-45594
Description
Decidim is a participatory democracy framework. The meeting embeds feature used in the online or hybrid meetings is subject to potential XSS attack through a malformed URL. This vulnerability is fixed in 0.28.3 and 0.29.0.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
decidim-meetingsRubyGems | >= 0.28.0, < 0.28.3 | 0.28.3 |
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
3- github.com/advisories/GHSA-j4h6-gcj7-7v9vghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2024-45594ghsaADVISORY
- github.com/decidim/decidim/security/advisories/GHSA-j4h6-gcj7-7v9vghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.