{"id":"CVE-2024-27095","aliases":["EUVD-2024-2253","GHSA-529p-jj47-w3m3"],"status":"published","title":"Decidim cross-site scripting (XSS) in the admin panel","description":"Decidim is a participatory democracy framework. The admin panel is subject to potential XSS attach in case the attacker manages to modify some records being uploaded to the server. This vulnerability is fixed in 0.27.6 and 0.28.1.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00341,"percentile":0.27926,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2024-07-10T16:02:07Z","modified":"2026-10-28T02:30:35Z","fixes":[{"ecosystem":"RubyGems","package":"decidim-admin","fixed_in":["0.27.6","0.28.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"decidim-admin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.6"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"decidim-admin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.28.0.rc1"},{"fixed":"0.28.1"}]}]},{"source":"osv","ecosystem":"RubyGems","package":"decidim-admin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.6"}]}],"versions":["0.0.1","0.0.1.alpha3","0.0.1.alpha4","0.0.1.alpha5","0.0.1.alpha6","0.0.1.alpha7","0.0.1.alpha8","0.0.1.alpha9","0.0.2","0.0.3","0.0.5","0.0.6","0.0.7","0.0.8.1","0.1.0","0.10.0","0.10.1","0.11.0.pre1","0.11.1","0.11.2","0.12.0","0.12.0.pre","0.12.1","0.12.2","0.13.0","0.13.0.pre1","0.13.1","0.14.1","0.14.2","0.14.3","0.14.4","0.15.0","0.15.1","0.15.2","0.16.0","0.16.1","0.17.0","0.17.1","0.17.2","0.18.0","0.18.1","0.19.0","0.19.1","0.2.0","0.20.0","0.20.1","0.21.0","0.22.0","0.23.0","0.23.1","0.23.1.rc1","0.23.2","0.23.3","0.23.4","0.23.5","0.23.6","0.24.0","0.24.0.rc1","0.24.0.rc2","0.24.1","0.24.2","0.24.3","0.25.0","0.25.0.rc1","0.25.0.rc2","0.25.0.rc3","0.25.0.rc4","0.25.1","0.25.2","0.26.0","0.26.0.rc1","0.26.0.rc2","0.26.1","0.26.10","0.26.2","0.26.3","0.26.4","0.26.5","0.26.7","0.26.8","0.26.9","0.27.0","0.27.0.rc1","0.27.0.rc2","0.27.1","0.27.2","0.27.3","0.27.4","0.27.5","0.3.0","0.3.1","0.3.2","0.4.0","0.4.1","0.4.2","0.4.3","0.4.4","0.5.0","0.5.1","0.6.0","0.6.1","0.6.2","0.6.3","0.6.4","0.6.5","0.6.6","0.6.7","0.6.8","0.7.0","0.7.1","0.7.2","0.7.3","0.7.4","0.8.0","0.8.1","0.8.2","0.8.3","0.8.4","0.9.0","0.9.1","0.9.2","0.9.3"]},{"source":"osv","ecosystem":"RubyGems","package":"decidim-admin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.28.0.rc1"},{"fixed":"0.28.1"}]}],"versions":["0.28.0","0.28.0.rc4","0.28.0.rc5"]}],"products":[{"vendor":"decidim","product":"decidim"}],"references":[{"url":"https://github.com/decidim/decidim/security/advisories/GHSA-529p-jj47-w3m3","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/decidim/decidim/releases/tag/v0.27.6","tags":["x_refsource_MISC","x_transferred","Release Notes","web"]},{"url":"https://github.com/decidim/decidim/releases/tag/v0.28.1","tags":["x_refsource_MISC","x_transferred","Release Notes","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-27095","tags":["advisory"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim-admin/CVE-2024-27095.yml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-529p-jj47-w3m3"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/27xxx/CVE-2024-27095.json","tags":["advisory"]},{"url":"https://github.com/decidim/decidim","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-27095","title":"Decidim cross-site scripting (XSS) in the admin panel","description":"Decidim is a participatory democracy framework. The admin panel is subject to potential XSS attach in case the attacker manages to modify some records being uploaded to the server. This vulnerability is fixed in 0.27.6 and 0.28.1.","status":"published","published":"2024-07-10T19:07:45.995Z","modified":"2024-08-02T00:27:59.577Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:34:12.982241Z"}],"euvd":[{"id":"EUVD-2024-2253","description":"Decidim is a participatory democracy framework. The admin panel is subject to potential XSS attach in case the attacker manages to modify some records being uploaded to the server. This vulnerability is fixed in 0.27.6 and 0.28.1.","status":"published","published":"2024-07-10T19:07:45Z","modified":"2024-08-02T00:27:59Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T03:50:27.194572Z"}],"ghsa":[{"id":"GHSA-529p-jj47-w3m3","title":"Decidim cross-site scripting (XSS) in the admin panel","description":"### Impact\n\nThe admin panel is subject to potential XSS attach in case the attacker manages to modify some records being uploaded to the server.\n\nThe attacker is able to change  e.g. to `\u003csvg onload=alert('XSS')\u003e` if they know how to craft these requests themselves. And then enter the returned blob ID to the form inputs manually by modifying the edit page source.\n\n### Patches\n\nAvailable in versions 0.27.6 and 0.28.1.\n\n### Workarounds\n\nReview the user accounts that have access to the admin panel (i.e. general Administrators, and participatory space's Administrators) and remove access to them if they don't need it. \n\n### References\n\nOWASP ASVS v4.0.3-5.1.3\n","status":"published","published":"2024-07-10T16:02:07Z","modified":"2024-07-31T05:02:57Z","cvss":[{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","level":"medium"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:37:56.530214Z"}],"nvd":[{"id":"CVE-2024-27095","description":"Decidim is a participatory democracy framework. The admin panel is subject to potential XSS attach in case the attacker manages to modify some records being uploaded to the server. This vulnerability is fixed in 0.27.6 and 0.28.1.","status":"published","published":"2024-07-10T19:15:10.407Z","modified":"2026-06-17T07:19:09.157Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:10:12.016585Z"}],"osv":[{"id":"CVE-2024-27095","title":"Decidim cross-site scripting (XSS) in the admin panel","description":"Decidim is a participatory democracy framework. The admin panel is subject to potential XSS attach in case the attacker manages to modify some records being uploaded to the server. This vulnerability is fixed in 0.27.6 and 0.28.1.","status":"published","published":"2024-07-10T19:07:45.995Z","modified":"2026-10-28T02:30:35.062521541Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:44:39.569658Z"},{"id":"GHSA-529p-jj47-w3m3","title":"Decidim cross-site scripting (XSS) in the admin panel","description":"### Impact\n\nThe admin panel is subject to potential XSS attach in case the attacker manages to modify some records being uploaded to the server.\n\nThe attacker is able to change  e.g. to `\u003csvg onload=alert('XSS')\u003e` if they know how to craft these requests themselves. And then enter the returned blob ID to the form inputs manually by modifying the edit page source.\n\n### Patches\n\nAvailable in versions 0.27.6 and 0.28.1.\n\n### Workarounds\n\nReview the user accounts that have access to the admin panel (i.e. general Administrators, and participatory space's Administrators) and remove access to them if they don't need it. \n\n### References\n\nOWASP ASVS v4.0.3-5.1.3\n","status":"published","published":"2024-07-10T16:02:07Z","modified":"2026-09-10T03:50:16.342986673Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N","level":"medium"},{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:37.864461Z"}]}}