Cross-Site Scripting in Decidim's Admin Panel by Decidim

CVE-2024-32034

What is CVE-2024-32034?

The Decidim platform, an open-source tool intended for participatory democracy and citizen engagement, contains a Cross-Site Scripting vulnerability within its admin panel. This vulnerability can be exploited when an administrator assigns a valuation to a proposal or performs actions that generate an admin activity log containing a crafted XSS payload. To address this issue, users are urged to upgrade to version 0.27.7, 0.28.2 or newer. For users who cannot immediately upgrade, a temporary mitigation strategy includes redirecting access to the /admin and /admin/logs pages to other administrative functions to prevent unauthorized access.

References