Vulnerability Description
Decidim is a participatory democracy framework. Starting in version 0.23.0 and prior to versions 0.27.5 and 0.28.0, the CSRF authenticity token check is disabled for the questionnaire templates preview. The issue does not imply a serious security thread as you need to have access also to the session cookie in order to see this resource. This URL does not allow modifying the resource but it may allow attackers to gain access to information which was not meant to be public. The issue is fixed in version 0.27.5 and 0.28.0. As a workaround, disable the templates functionality or remove all available templates.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Decidim | Decidim | >= 0.23.0, < 0.27.5 |
Related Weaknesses (CWE)
References
- https://github.com/decidim/decidim/blob/3187bdfd40ea1c57c2c12512b09a7fec0b2bed08Product
- https://github.com/decidim/decidim/commit/5542227be66e3b6d7530f5b536069bce093766Patch
- https://github.com/decidim/decidim/commit/57a4b467787448307b5d9b01ce6e2c8502e121Patch
- https://github.com/decidim/decidim/pull/11743Issue Tracking
- https://github.com/decidim/decidim/pull/6247Issue Tracking
- https://github.com/decidim/decidim/releases/tag/v0.27.5Release Notes
- https://github.com/decidim/decidim/releases/tag/v0.28.0Release Notes
- https://github.com/decidim/decidim/security/advisories/GHSA-f3qm-vfc3-jg6vPatchVendor Advisory
- https://github.com/decidim/decidim/blob/3187bdfd40ea1c57c2c12512b09a7fec0b2bed08Product
- https://github.com/decidim/decidim/commit/5542227be66e3b6d7530f5b536069bce093766Patch
- https://github.com/decidim/decidim/commit/57a4b467787448307b5d9b01ce6e2c8502e121Patch
- https://github.com/decidim/decidim/pull/11743Issue Tracking
- https://github.com/decidim/decidim/pull/6247Issue Tracking
- https://github.com/decidim/decidim/releases/tag/v0.27.5Release Notes
- https://github.com/decidim/decidim/releases/tag/v0.28.0Release Notes
FAQ
What is CVE-2023-47635?
CVE-2023-47635 is a vulnerability with a CVSS score of 4.5 (MEDIUM). Decidim is a participatory democracy framework. Starting in version 0.23.0 and prior to versions 0.27.5 and 0.28.0, the CSRF authenticity token check is disabled for the questionnaire templates previe...
How severe is CVE-2023-47635?
CVE-2023-47635 has been rated MEDIUM with a CVSS base score of 4.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-47635?
Check the references section above for vendor advisories and patch information. Affected products include: Decidim Decidim.