Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. Decidim uses a third-party library named Ransack for filtering certain database collections (e.g., public meetings). By default, this library allows filtering on all data attributes and associations. This allows an unauthenticated remote attacker to exfiltrate non-public data from the underlying database of a Decidim instance (e.g., exfiltrating data from the user table). This issue may lead to Sensitive Data Disclosure. The problem was patched in version 0.27.3.
oryginał ENCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NDecidim
APPDecidim< 0.27.3
Powiązane podatności
Stored XSS w polu nazwy użytkownika Decidim umożliwia zdalne wykonanie kodu
Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelo...
Decidim is a participatory democracy framework. Starting in version 0.19.0 and prior to versions 0.30.5 and 0....
Decidim is a participatory democracy framework. In versions from 0.30.0 to before 0.30.4 and from 0.31.0.rc1 t...
Decidim is a participatory democracy framework. The meeting embeds feature used in the online or hybrid meetin...