CVE-2023-34090

Katalog CVE

CVSS 7.5 · High EPSS 1,3%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada decidim. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. Decidim uses a third-party library named Ransack for filtering certain database collections (e.g., public meetings). By default, this library allows filtering on all data attributes and associations. This allows an unauthenticated remote attacker to exfiltrate non-public data from the underlying database of a Decidim instance (e.g., exfiltrating data from the user table). This issue may lead to Sensitive Data Disclosure. The problem was patched in version 0.27.3.

Rincian

Terbit di NVD

11 Juli 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

EPSS (30 hari)

1,3% peluang dieksploitasi; lebih tinggi dari 68,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/decidim/decidim/releases/tag/v0.27.3 patch · advisory pihak ketiga
• https://github.com/decidim/decidim/security/advisories/GHSA-jm79-9pm4-vrw9 advisory pihak ketiga
• https://github.com/decidim/decidim/security/advisories/GHSA-jm79-9pm4-vrw9#advisory-comment-81110 advisory pihak ketiga