CVE-2025-65017

Katalog CVE

CVSS 6.5 · Medium EPSS 0,31%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada decidim. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

Decidim is a participatory democracy framework. In versions from 0.30.0 to before 0.30.4 and from 0.31.0.rc1 to before 0.31.0, the private data exports can lead to data leaks in case the UUID generation, causing collisions for the generated UUIDs. This issue has been patched in versions 0.30.4 and 0.31.0.

Rincian

Terbit di NVD

3 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-703: Improper Check or Handling of Exceptional Conditions

EPSS (30 hari)

0,31% peluang dieksploitasi; lebih tinggi dari 21,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/decidim/decidim/security/advisories/GHSA-3cx6-j9j4-54mp advisory vendor
• https://github.com/decidim/decidim/pull/13571 issue tracking · patch
• https://github.com/decidim/decidim/releases/tag/v0.30.4 release notes
• https://github.com/decidim/decidim/releases/tag/v0.31.0 release notes