Detections
Analytics

SCA: security update for decidim, decidim-core (GHSA-9w99-78rj-hmxq)

medium Tenable Cloud Security Plugin ID 413508

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Decidim is a participatory democracy framework. Starting in version 0.27.0 and prior to versions 0.27.5
 and 0.28.0, the dynamic file upload feature is subject to potential cross-site scripting attacks in case
 the attacker manages to modify the file names of the records being uploaded to the server. This appears in
 sections where the user controls the file upload dialogs themselves and has the technical knowledge to
 change the file names through the dynamic upload endpoint. Therefore I believe it would require the
 attacker to control the whole session of the particular user but in any case, this needs to be fixed.
 Successful exploit of this vulnerability would require the user to have successfully uploaded a file blob
 to the server with a malicious file name and then have the possibility to direct the other user to the
 edit page of the record where the attachment is attached. The users are able to craft the direct upload
 requests themselves controlling the file name that gets stored to the database. The attacker is able to
 change the filename e.g. to `<svg onload=alert('XSS')>` if they know how to craft these requests
 themselves. And then enter the returned blob ID to the form inputs manually by modifying the edit page
 source. Versions 0.27.5 and 0.28.0 contain a patch for this issue. As a workaround, disable dynamic
 uploads for the instance, e.g. from proposals. (CVE-2023-51447)

Solution

Update the decidim library and its related packages to version 0.27.5 or later.

See Also

https://github.com/advisories/GHSA-9w99-78rj-hmxq

Plugin Details

Severity: Medium

ID: 413508

Version: Revision 1.14

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 2.3

Percentile: 9.14

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.1

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:N

CVSS Score Source: CVE-2023-51447

CVSS v3

Risk Factor: Medium

Base Score: 5.4

Temporal Score: 4.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 2/20/2024

Vulnerability Publication Date: 2/20/2024

Reference Information

CVE: CVE-2023-51447

cwe: CWE-79