{"id":"CVE-2024-27095","state":"PUBLISHED","title":"Decidim cross-site scripting (XSS) in the admin panel","description":"Decidim is a participatory democracy framework. The admin panel is subject to potential XSS attach in case the attacker manages to modify some records being uploaded to the server. This vulnerability is fixed in 0.27.6 and 0.28.1.","publishedAt":"2024-07-10T19:07:45.995Z","updatedAt":"2024-08-02T00:27:59.577Z","severity":{"score":5.4,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N","source":"GitHub_M"},"assigner":"GitHub_M","products":["decidim decidim"],"affected":[{"vendor":"decidim","product":"decidim","versions":[{"version":"< 0.27.6","status":"affected"},{"version":">= 0.28.0.rc1, < 0.28.1","status":"affected"}]}],"references":["https://github.com/decidim/decidim/security/advisories/GHSA-529p-jj47-w3m3","https://github.com/decidim/decidim/releases/tag/v0.27.6","https://github.com/decidim/decidim/releases/tag/v0.28.1"],"weaknesses":["CWE-79"],"ingestedAt":"2026-10-29T20:07:10.607Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/27xxx/CVE-2024-27095.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-27095","state":"PUBLISHED","datePublished":"2024-07-10T19:07:45.995Z","dateUpdated":"2024-08-02T00:27:59.577Z","assignerShortName":"GitHub_M","assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateReserved":"2024-02-19T14:43:05.993Z"},"containers":{"cna":{"title":"Decidim cross-site scripting (XSS) in the admin panel","descriptions":[{"lang":"en","value":"Decidim is a participatory democracy framework. The admin panel is subject to potential XSS attach in case the attacker manages to modify some records being uploaded to the server. This vulnerability is fixed in 0.27.6 and 0.28.1."}],"affected":[{"vendor":"decidim","product":"decidim","versions":[{"version":"< 0.27.6","status":"affected"},{"version":">= 0.28.0.rc1, < 0.28.1","status":"affected"}]}],"references":[{"url":"https://github.com/decidim/decidim/security/advisories/GHSA-529p-jj47-w3m3","name":"https://github.com/decidim/decidim/security/advisories/GHSA-529p-jj47-w3m3","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/decidim/decidim/releases/tag/v0.27.6","name":"https://github.com/decidim/decidim/releases/tag/v0.27.6","tags":["x_refsource_MISC"]},{"url":"https://github.com/decidim/decidim/releases/tag/v0.28.1","name":"https://github.com/decidim/decidim/releases/tag/v0.28.1","tags":["x_refsource_MISC"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","lang":"en","description":"CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","type":"CWE"}]}],"providerMetadata":{"shortName":"GitHub_M","orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateUpdated":"2024-07-10T19:07:45.995Z"},"source":{"advisory":"GHSA-529p-jj47-w3m3","discovery":"UNKNOWN"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-07-10T19:56:08.980647Z","id":"CVE-2024-27095","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-07-10T19:56:37.741Z"}},{"title":"CVE Program Container","references":[{"url":"https://github.com/decidim/decidim/security/advisories/GHSA-529p-jj47-w3m3","name":"https://github.com/decidim/decidim/security/advisories/GHSA-529p-jj47-w3m3","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://github.com/decidim/decidim/releases/tag/v0.27.6","name":"https://github.com/decidim/decidim/releases/tag/v0.27.6","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://github.com/decidim/decidim/releases/tag/v0.28.1","name":"https://github.com/decidim/decidim/releases/tag/v0.28.1","tags":["x_refsource_MISC","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T00:27:59.577Z"}}]}}}