Loading HuntDB...
Hunt
Vulnerability Intelligence by wss.sh
Home Daily Briefings High Impact CVEs Recent Exploits KEV Catalog GitHub Advisories Latest Updates Security News
Sign In Sign Up

CVE-2023-34090

HIGH
Published 2023-07-11T17:29:36.629Z
Actions:

Expert Analysis

Professional remediation guidance

Get tailored security recommendations from our analyst team for CVE-2023-34090. We'll provide specific mitigation strategies based on your environment and risk profile.

CVSS Score

V3.1
7.5
/10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Base Score Metrics
Exploitability: N/A Impact: N/A

EPSS Score

v2025.03.14
0.002
probability
of exploitation in the wild

There is a 0.2% chance that this vulnerability will be exploited in the wild within the next 30 days.

Updated: 2025-06-25
Exploit Probability
Percentile: 0.420
Higher than 42.0% of all CVEs

Attack Vector Metrics

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED

Impact Metrics

Confidentiality
HIGH
Integrity
NONE
Availability
NONE

Description

Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. Decidim uses a third-party library named Ransack for filtering certain database collections (e.g., public meetings). By default, this library allows filtering on all data attributes and associations. This allows an unauthenticated remote attacker to exfiltrate non-public data from the underlying database of a Decidim instance (e.g., exfiltrating data from the user table). This issue may lead to Sensitive Data Disclosure. The problem was patched in version 0.27.3.

Available Exploits

No exploits available for this CVE.

Related News

No news articles found for this CVE.

Affected Products

decidim

decidim

Affected Versions:

>= 0.27.0, < 0.27.3
decidim

decidim

Affected Versions:

0.27.0

GitHub Security Advisories

Community-driven vulnerability intelligence from GitHub

✓ GitHub Reviewed HIGH

Decidim vulnerable to sensitive data disclosure

GHSA-jm79-9pm4-vrw9

Advisory Details

Note: added the actual report as a [comment](https://github.com/decidim/decidim/security/advisories/GHSA-jm79-9pm4-vrw9#advisory-comment-81110). ### Summary Decidim, a platform for digital citizen participation, uses a third-party library named Ransack for filtering certain database collections (e.g., public meetings). By default, this library allows filtering on all data attributes and associations. This allows an unauthenticated remote attacker to exfiltrate non-public data from the underlying database of a Decidim instance (e.g., exfiltrating data from the user table). ### Impact This issue may lead to Sensitive Data Disclosure. ### Patches The problem was patched in [v0.27.3](https://github.com/decidim/decidim/releases/tag/v0.27.3). ### Workarounds Disable or unpublish all meetings components from your application.

Affected Packages

RubyGems decidim
ECOSYSTEM: ≥0.27.0 <0.27.3
RubyGems decidim-meetings
ECOSYSTEM: ≥0.27.0 <0.27.3

CVSS Scoring

CVSS Score

7.5

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

WEB https://github.com/decidim/decidim/security/advisories/GHSA-jm79-9pm4-vrw9
WEB https://github.com/decidim/decidim/security/advisories/GHSA-jm79-9pm4-vrw9#advisory-comment-81110
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2023-34090
PACKAGE https://github.com/decidim/decidim
WEB https://github.com/decidim/decidim/releases/tag/v0.27.3
WEB https://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim-meetings/CVE-2023-34090.yml
WEB https://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim/CVE-2023-34090.yml

Advisory provided by GitHub Security Advisory Database. Published: July 11, 2023, Modified: July 11, 2023

References

https://github.com/decidim/decidim/security/advisories/GHSA-jm79-9pm4-vrw9
https://github.com/decidim/decidim/security/advisories/GHSA-jm79-9pm4-vrw9#advisory-comment-81110
https://github.com/decidim/decidim/releases/tag/v0.27.3
Published: 2023-07-11T17:29:36.629Z
Last Modified: 2024-10-23T15:27:20.029Z
Copied to clipboard!