diff --git a/advisories/github-reviewed/2024/11/GHSA-j4h6-gcj7-7v9v/GHSA-j4h6-gcj7-7v9v.json b/advisories/github-reviewed/2024/11/GHSA-j4h6-gcj7-7v9v/GHSA-j4h6-gcj7-7v9v.json new file mode 100644 index 00000000000..600bd82bf4e --- /dev/null +++ b/advisories/github-reviewed/2024/11/GHSA-j4h6-gcj7-7v9v/GHSA-j4h6-gcj7-7v9v.json @@ -0,0 +1,61 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-j4h6-gcj7-7v9v", + "modified": "2024-11-13T17:24:40Z", + "published": "2024-11-13T17:24:40Z", + "aliases": [ + "CVE-2024-45594" + ], + "summary": "decidim-meetings Cross-site scripting vulnerability in the online or hybrid meeting embeds", + "details": "### Impact\n\nThe meeting embeds feature used in the online or hybrid meetings is subject to potential XSS attack through a malformed URL.\n\n### Patches\n\nNot available\n\n### Workarounds\n\nDisable the creation of meetings by participants in the meeting component.\n\n### References\n\nOWASP ASVS v4.0.3-5.1.3\n\n### Credits\n\nThis issue was discovered in a security audit organized by mitgestalten Partizipationsbüro against Decidim. The security audit was implemented by the Austrian Institute of Technology.\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "RubyGems", + "name": "decidim-meetings" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0.28.0" + }, + { + "fixed": "0.28.3" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/decidim/decidim/security/advisories/GHSA-j4h6-gcj7-7v9v" + }, + { + "type": "PACKAGE", + "url": "https://github.com/decidim/decidim" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-11-13T17:24:40Z", + "nvd_published_at": null + } +} \ No newline at end of file