CVE-2024-45594highCWE-79

CVE-2024-45594: falha de alta gravidade em decidim

Decidim allows cross-site scripting (XSS) in the online or hybrid meeting embeds

Publicada em

Seguir esta CVE+ Monitorar decidim+ Monitorar decidim-meetings

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.7epss 0.3%
Decidim is a participatory democracy framework. The meeting embeds feature used in the online or hybrid meetings is subject to potential XSS attack through a malformed URL. This vulnerability is fixed in 0.28.3 and 0.29.0.
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
Produtos afetados
decidim · decidim
CVEs relacionadas — decidim

No mesmo produto, das mais perigosas para as menos.

CVE-2023-34090HIGHDecidim vulnerable to sensitive data disclosureEPSS 1.3%CVE-2023-32693HIGHDecidim Cross-site Scripting vulnerability in the external link redirectionsEPSS 0.8%CVE-2023-48220MEDIUMDecidim's devise_invitable gem vulnerable to circumvention of invitation token expiry periodEPSS 0.8%CVE-2023-34089HIGHDecidim Cross-site Scripting vulnerability in the processes filterEPSS 0.7%CVE-2023-36465CRITICALDecidim has broken access control in templatesEPSS 0.7%CVE-2026-45376MEDIUMDecidim: Admin user search allows SQL injection through similarity-based sortingEPSS 0.6%