github - ghsa-vvqw-fqwx-mqmm

ghsa-vvqw-fqwx-mqmm

Vulnerability from github

Published

2024-09-16 17:17

Modified

2024-09-17 22:27

Severity ?

5.4 (Medium) - CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N
5.9 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N

Summary

Decidim::Admin vulnerable to cross-site scripting (XSS) in the admin panel with QuillJS WYSWYG editor

Details

Impact

The WYSWYG editor QuillJS is subject to potential XSS attach in case the attacker manages to modify the HTML before being uploaded to the server.

The attacker is able to change e.g. to if they know how to craft these requests themselves.

Patches

N/A

Workarounds

Review the user accounts that have access to the admin panel (i.e. general Administrators, and participatory space's Administrators) and remove access to them if they don't need it.

Disable the "Enable rich text editor for participants" setting in the admin dashboard

References

OWASP ASVS v4.0.3-5.1.3

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.27.6"
      },
      "package": {
        "ecosystem": "RubyGems",
        "name": "decidim"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.27.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-39910"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-09-16T17:17:54Z",
    "nvd_published_at": "2024-09-16T19:16:10Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nThe WYSWYG editor QuillJS is subject to potential XSS attach in case the attacker manages to modify the HTML before being uploaded to the server.\n\nThe attacker is able to change e.g. to \u003csvg onload=alert(\u0027XSS\u0027)\u003e if they know how to craft these requests themselves. \n\n### Patches\n\nN/A\n\n### Workarounds\n\nReview the user accounts that have access to the admin panel (i.e. general Administrators, and participatory space\u0027s Administrators) and remove access to them if they don\u0027t need it. \n\nDisable the \"Enable rich text editor for participants\" setting in the admin dashboard\n\n### References\n\nOWASP ASVS v4.0.3-5.1.3\n",
  "id": "GHSA-vvqw-fqwx-mqmm",
  "modified": "2024-09-17T22:27:43Z",
  "published": "2024-09-16T17:17:54Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/decidim/decidim/security/advisories/GHSA-vvqw-fqwx-mqmm"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39910"
    },
    {
      "type": "WEB",
      "url": "https://github.com/decidim/decidim/commit/47adca81cabea898005ec07b130b008f2a2be99f"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/decidim/decidim"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim/CVE-2024-39910.yml"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": " Decidim::Admin vulnerable to cross-site scripting (XSS) in the admin panel with QuillJS WYSWYG editor"
}

CVE-2024-39910 (GCVE-0-2024-39910)

Vulnerability from cvelistv5

Published

2024-09-16 18:38

Modified

2024-09-16 19:58

Severity ?

5.4 (Medium) - CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Summary

decidim is a Free Open-Source participatory democracy, citizen participation and open government for cities and organizations. The WYSWYG editor QuillJS is subject to potential XSS attach in case the attacker manages to modify the HTML before being uploaded to the server. The attacker is able to change e.g. to <svg onload=alert('XSS')> if they know how to craft these requests themselves. This issue has been addressed in release version 0.27.7. All users are advised to upgrade. Users unable to upgrade should review the user accounts that have access to the admin panel (i.e. general Administrators, and participatory space's Administrators) and remove access to them if they don't need it. Disable the "Enable rich text editor for participants" setting in the admin dashboard

References

URL

Tags

	https://github.com/decidim/decidim/security/advisories/GHSA-vvqw-fqwx-mqmm	x_refsource_CONFIRM
	https://github.com/decidim/decidim/commit/47adca81cabea898005ec07b130b008f2a2be99f	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	decidim	decidim	Version: < 0.27.7

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-39910",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-16T19:57:51.999340Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-16T19:58:06.959Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "decidim",
          "vendor": "decidim",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.27.7"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "decidim is a Free Open-Source participatory democracy, citizen participation and open government for cities and organizations. The WYSWYG editor QuillJS is subject to potential XSS attach in case the attacker manages to modify the HTML before being uploaded to the server. The attacker is able to change e.g. to \u003csvg onload=alert(\u0027XSS\u0027)\u003e if they know how to craft these requests themselves. This issue has been addressed in release version 0.27.7. All users are advised to upgrade. Users unable to upgrade should review the user accounts that have access to the admin panel (i.e. general Administrators, and participatory space\u0027s Administrators) and remove access to them if they don\u0027t need it. Disable the \"Enable rich text editor for participants\" setting in the admin dashboard"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-16T18:38:11.423Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/decidim/decidim/security/advisories/GHSA-vvqw-fqwx-mqmm",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/decidim/decidim/security/advisories/GHSA-vvqw-fqwx-mqmm"
        },
        {
          "name": "https://github.com/decidim/decidim/commit/47adca81cabea898005ec07b130b008f2a2be99f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/decidim/decidim/commit/47adca81cabea898005ec07b130b008f2a2be99f"
        }
      ],
      "source": {
        "advisory": "GHSA-vvqw-fqwx-mqmm",
        "discovery": "UNKNOWN"
      },
      "title": "Cross-site scripting (XSS) in the decidim admin panel with QuillJS WYSWYG editor"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-39910",
    "datePublished": "2024-09-16T18:38:11.423Z",
    "dateReserved": "2024-07-02T19:37:18.601Z",
    "dateUpdated": "2024-09-16T19:58:06.959Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

ghsa-vvqw-fqwx-mqmm

Vulnerability from github

Impact

Patches

Workarounds

References

CVE-2024-39910 (GCVE-0-2024-39910)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature