| Package | Affected versions | Patched versions |
|---|---|---|
| decidim-core | ≥ 0.31.0.rc1, < 0.31.1< 0.30.5 | 0.31.10.30.5 |
| decidim | ≥ 0.31.0, < 0.31.1< 0.30.5 | 0.31.10.30.5 |
A stored code execution vulnerability in the user name field allows a low-privileged attacker to execute arbitrary code in the context of any user who passively visits a comment page, resulting in high confidentiality and integrity impact across security boundaries.
N/A
Not available
OWASP ASVS v4.0.3-5.1.3
This issue was discovered in a security audit organized by octree and made by Secu Labs against Decidim financed by the city of Lausanne (Switzerland).
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free