CVE-2023-36465
HIGH7.1EPSS 0.07%Decidim has broken access control in templates
Published: 10/5/2023Modified: 2/16/2024
Description
### Impact The `templates` module doesn't enforce the correct permissions, allowing any logged-in user to access to this functionality in the administration panel. An attacker could use this vulnerability to change, create or delete templates of surveys.
Affected packages (2)
- RubyGems/decidim>= 0.23.2, < 0.26.8
- RubyGems/decidim-templates>= 0.23.2, < 0.26.8
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | HIGH7.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L |
References (7)
- ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2023-36465
- PATCHhttps://github.com/decidim/decidim
- WEBhttps://github.com/decidim/decidim/releases/tag/v0.26.8
- WEBhttps://github.com/decidim/decidim/releases/tag/v0.27.4
- WEBhttps://github.com/decidim/decidim/security/advisories/GHSA-639h-86hw-qcjq
- WEBhttps://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim/CVE-2023-36465.yml
- WEBhttps://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim-templates/CVE-2023-36465.yml