mirror of
https://github.com/CVEProject/cvelist.git
synced 2025-08-04 08:44:25 +00:00
100 lines
3.5 KiB
JSON
100 lines
3.5 KiB
JSON
{
|
|
"data_version": "4.0",
|
|
"data_type": "CVE",
|
|
"data_format": "MITRE",
|
|
"CVE_data_meta": {
|
|
"ID": "CVE-2024-27095",
|
|
"ASSIGNER": "security-advisories@github.com",
|
|
"STATE": "PUBLIC"
|
|
},
|
|
"description": {
|
|
"description_data": [
|
|
{
|
|
"lang": "eng",
|
|
"value": "Decidim is a participatory democracy framework. The admin panel is subject to potential XSS attach in case the attacker manages to modify some records being uploaded to the server. This vulnerability is fixed in 0.27.6 and 0.28.1."
|
|
}
|
|
]
|
|
},
|
|
"problemtype": {
|
|
"problemtype_data": [
|
|
{
|
|
"description": [
|
|
{
|
|
"lang": "eng",
|
|
"value": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
|
|
"cweId": "CWE-79"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
"affects": {
|
|
"vendor": {
|
|
"vendor_data": [
|
|
{
|
|
"vendor_name": "decidim",
|
|
"product": {
|
|
"product_data": [
|
|
{
|
|
"product_name": "decidim",
|
|
"version": {
|
|
"version_data": [
|
|
{
|
|
"version_affected": "=",
|
|
"version_value": "< 0.27.6"
|
|
},
|
|
{
|
|
"version_affected": "=",
|
|
"version_value": ">= 0.28.0.rc1, < 0.28.1"
|
|
}
|
|
]
|
|
}
|
|
}
|
|
]
|
|
}
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"references": {
|
|
"reference_data": [
|
|
{
|
|
"url": "https://github.com/decidim/decidim/security/advisories/GHSA-529p-jj47-w3m3",
|
|
"refsource": "MISC",
|
|
"name": "https://github.com/decidim/decidim/security/advisories/GHSA-529p-jj47-w3m3"
|
|
},
|
|
{
|
|
"url": "https://github.com/decidim/decidim/releases/tag/v0.27.6",
|
|
"refsource": "MISC",
|
|
"name": "https://github.com/decidim/decidim/releases/tag/v0.27.6"
|
|
},
|
|
{
|
|
"url": "https://github.com/decidim/decidim/releases/tag/v0.28.1",
|
|
"refsource": "MISC",
|
|
"name": "https://github.com/decidim/decidim/releases/tag/v0.28.1"
|
|
}
|
|
]
|
|
},
|
|
"source": {
|
|
"advisory": "GHSA-529p-jj47-w3m3",
|
|
"discovery": "UNKNOWN"
|
|
},
|
|
"impact": {
|
|
"cvss": [
|
|
{
|
|
"attackComplexity": "HIGH",
|
|
"attackVector": "NETWORK",
|
|
"availabilityImpact": "NONE",
|
|
"baseScore": 5.4,
|
|
"baseSeverity": "MEDIUM",
|
|
"confidentialityImpact": "HIGH",
|
|
"integrityImpact": "NONE",
|
|
"privilegesRequired": "HIGH",
|
|
"scope": "CHANGED",
|
|
"userInteraction": "REQUIRED",
|
|
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N",
|
|
"version": "3.1"
|
|
}
|
|
]
|
|
}
|
|
} |