Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
4 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
The admin organization user search uses the untrusted term value inside raw SQL ORDER BY expressions. Because the value is interpolated before Rails sanitization is applied, a crafted search string is executed by PostgreSQL as part of the sort expression. Technical description The vulnerable endpoint is exposed as GET /admin/organization/users in decidim-admin/config/routes.rb: That route reaches Decidim::Admin::OrganizationController#users, which forwards the current organization's available users into search: Inside search, the attacker-controlled source is params[:term]: The query has two branches. In both branches, the WHERE predicates use bind parameters and are not the injection sink. The vulnerability is in the subsequent .order(Arel.sql(...)) calls, where the untrusted value is interpolated directly into SQL string literals. Nickname branch: Name/email branch: This use of sanitizesqlarray does not make the code safe. The interpolation happens first, so Rails receives an…
Recommended action: Upgrade to 0.32.0, 0.31.5 or 0.30.9 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The admin panel is subject to potential XSS attach in case an admin assigns a valuator to a proposal, or does any other action that generates an admin activity log where one of the resources has an XSS crafted. Patches N/A Workarounds Redirect the pages /admin and /admin/logs to other admin pages to prevent this access (i.e. /admin/organization/edit) References OWASP ASVS v4.0.3-5.1.3
Recommended action: Upgrade to 0.28.2 or 0.27.7 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The admin panel is subject to potential XSS attach in case the attacker manages to modify some records being uploaded to the server. The attacker is able to change e.g. to <svg onload=alert('XSS') if they know how to craft these requests themselves. And then enter the returned blob ID to the form inputs manually by modifying the edit page source. Patches Available in versions 0.27.6 and 0.28.1. Workarounds Review the user accounts that have access to the admin panel (i.e. general Administrators, and participatory space's Administrators) and remove access to them if they don't need it. References OWASP ASVS v4.0.3-5.1.3
Recommended action: Upgrade to 0.28.1 or 0.27.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The invites feature allows users to accept the invitation for an unlimited amount of time through the password reset functionality. When using the password reset functionality, the deviseinvitable gem always accepts the pending invitation if the user has been invited as shown in this piece of code within the deviseinvitable gem: https://github.com/scambra/deviseinvitable/blob/41f58970ff76fb64382a9b9ea1bd530f7c3adab2/lib/deviseinvitable/models.rb#L198 The only check done here is if the user has been invited but the code does not ensure that the pending invitation is still valid as defined by the invitefor expiry period as explained in the gem's documentation: https://github.com/scambra/deviseinvitable#model-configuration- invitefor: The period the generated invitation token is valid. After this period, the invited resource won’t be able to accept the invitation. When invitefor is 0 (the default), the invitation won’t expire. Decidim sets this configuration to 2.weeks so this…
Recommended action: Upgrade to 0.27.5 or 0.26.9 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.