Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

RubyGems package

decidim-decidim_awesome

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.5RubyGemsPublished

    Decidim-Awesome has SQL injection in AdminAccountability

    CVE-2024-43415 · GHSA-cxwf-qc32-375f

    Affected
    • RubyGems decidim-decidim_awesome >= 0.9.1, < 0.10.3; >= 0.11.0, < 0.11.2
    Fixed in
    0.11.20.10.3· Vendor fix available
    Issue
    Vulnerability type: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vendor: Decidim International Community Environment Has vendor confirmed: Yes Attack type: Remote Impact: Code Execution Escalation of Privileges Information Disclosure Affected component: A raw sql-statement that uses an interpolated variable exists in the adminroleactions method of the papertrail/version-model(app/models/decidim/decidimawesome/papertrailversion.rb). Attack vector: An attacker with admin permissions could manipulate database queries in order to read out the database, read files from the filesystem, write files from the filesystem. In the worst case, this could lead to remote code execution on the server. Description of the vulnerability for use in the CVE [ℹ] (https://cveproject.github.io/docs/content/key-details- phrasing.pdf) : An improper neutralization of special elements used in an SQL command in the papertrail/version- model of the decidimawesome-module…

    Recommended action: Upgrade to 0.11.2 or 0.10.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →