Decidim cross-site scripting (XSS) in the pagination
Package
Affected versions
< 0.27.6
>= 0.28.0.rc1, < 0.28.1
Patched versions
0.27.6
0.28.1
Description
Published to the GitHub Advisory Database
Jul 10, 2024
Reviewed
Jul 10, 2024
Published by the National Vulnerability Database
Jul 10, 2024
Last updated
Aug 3, 2024
Credits
-
PatrickHimler Analyst
Impact
The pagination feature used in searches and filters is subject to potential XSS attack through a malformed URL using the GET parameter
per_page.Patches
Not available
Workarounds
Not available
References
OWASP ASVS v4.0.3-5.1.3
Credits
This issue was discovered in a security audit organized by the mitgestalten Partizipationsbüro and funded by netidee against Decidim done during April 2024. The security audit was implemented by AIT Austrian Institute of Technology GmbH,
References