CVE-2023-34090 Decidim vulnerable to sensitive data disclosure

2023-07-1117:29:36

CWE-200

GitHub_M

www.cve.org

decidim

sensitive data disclosure

ruby on rails

ransack

barcelona city.

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

0.001 Low

EPSS

Percentile

43.1%

JSON

Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. Decidim uses a third-party library named Ransack for filtering certain database collections (e.g., public meetings). By default, this library allows filtering on all data attributes and associations. This allows an unauthenticated remote attacker to exfiltrate non-public data from the underlying database of a Decidim instance (e.g., exfiltrating data from the user table). This issue may lead to Sensitive Data Disclosure. The problem was patched in version 0.27.3.

CNA Affected

[
  {
    "vendor": "decidim",
    "product": "decidim",
    "versions": [
      {
        "version": ">= 0.27.0, < 0.27.3",
        "status": "affected"
      }
    ]
  }
]