Andreslucena

**Name of the Vulnerable Software and Affected Versions** Decidim versions prior to 0.27.7 Decidim versions prior to 0.28.2 **Description** The admin panel of Decidim is subject to potential Cross-site scripting (XSS) attacks when an admin assigns a valuator to a proposal or performs any other action that generates an admin activity log with an XSS crafted resource. **Recommendations** For versions prior to 0.27.7, upgrade to version 0.27.7 or newer. For versions prior to 0.28.2, upgrade to version 0.28.2 or newer. As a temporary workaround for users unable to upgrade, consider redirecting the pages "/admin" and "/admin/logs" to other admin pages, such as "/admin/organization/edit", to prevent access.

**Name of the Vulnerable Software and Affected Versions** decidim versions prior to 0.27.7 **Description** The WYSWYG editor QuillJS in decidim is subject to potential XSS attacks if an attacker manages to modify the HTML before it is uploaded to the server. The attacker can change code, for example, to `<svg onload=alert('XSS')>` if they know how to craft these requests themselves. **Recommendations** For versions prior to 0.27.7, upgrade to version 0.27.7. As a temporary workaround for users unable to upgrade, review the user accounts that have access to the admin panel and remove access to them if they don't need it. Disable the "Enable rich text editor for participants" setting in the admin dashboard.

**Name of the Vulnerable Software and Affected Versions** Decidim versions prior to 0.27.6 **Description** Decidim is a participatory democracy framework, written in Ruby on Rails. If an attacker can infer the slug or URL of an unpublished or private resource, and this resource can be embedded, then some data of this resource could be accessed. **Recommendations** For versions prior to 0.27.6, update to version 0.27.6 to resolve the issue. As a temporary workaround, consider disallowing access through your web server to the URLs finished with `/embed.html` until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Decidim versions prior to 0.27.6 Decidim versions prior to 0.28.1 **Description** Decidim is a participatory democracy framework. The admin panel is subject to potential cross-site scripting (XSS) attack in case the attacker manages to modify some records being uploaded to the server. This can occur if the attacker knows how to craft specific requests and modify the edit page source to enter a returned blob ID to the form inputs manually. **Recommendations** For Decidim versions prior to 0.27.6, update to version 0.27.6 or later. For Decidim versions prior to 0.28.1, update to version 0.28.1 or later. As a temporary workaround, review the user accounts that have access to the admin panel and remove access to them if they don't need it.

**Name of the Vulnerable Software and Affected Versions** Decidim versions 0.23.0 through 0.27.4 Decidim versions 0.28.0 before the fix **Description** Decidim is a participatory democracy framework. The CSRF authenticity token check is disabled for the questionnaire templates preview, which may allow attackers to gain access to information that was not meant to be public. This issue does not imply a serious security threat as access to the session cookie is also required to see this resource. The URL does not allow modifying the resource. **Recommendations** For Decidim versions 0.23.0 through 0.27.4, update to version 0.27.5 or later. For Decidim versions 0.28.0 before the fix, update to the fixed version 0.28.0 or later. As a temporary workaround, consider disabling the templates functionality or removing all available templates to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Decidim versions prior to 0.26.8 Decidim versions prior to 0.27.4 **Description** Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. The `templates` module doesn't enforce the correct permissions, allowing any logged-in user to access this functionality in the administration panel. An attacker could use this issue to change, create, or delete templates of surveys. **Recommendations** For Decidim versions prior to 0.26.8, update to version 0.26.8 or later to resolve the issue. For Decidim versions prior to 0.27.4, update to version 0.27.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the `templates` module in the administration panel to minimize the risk of exploitation.