CVE-2023-32693

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2023-32693
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-32693.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2023-32693
Aliases
Published
2023-07-11T17:19:26.138Z
Modified
2025-11-29T14:16:17.397994Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N CVSS Calculator
Summary
Decidim Cross-site Scripting vulnerability in the external link redirections
Details

Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. The external link feature is susceptible to cross-site scripting. This allows a remote attacker to execute JavaScript code in the context of a currently logged-in user. An attacker could use this vulnerability to make other users endorse or support proposals they have no intention of supporting or endorsing. The problem was patched in versions 0.27.3 and 0.26.7.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/32xxx/CVE-2023-32693.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-79"
    ]
}
References

Affected packages

Git / github.com/decidim/decidim

Affected ranges

Type
GIT
Repo
https://github.com/decidim/decidim
Events
Introduced
297096130e1a09bd2cf8e4a7ac5e2b73ee61a5db
Fixed
0988ce9db54da0485a7ae5094b4b99fa2b153b45
Database specific 
{
    "versions": [
        {
            "introduced": "0.25.0"
        },
        {
            "fixed": "0.26.7"
        }
    ]
}
Type
GIT
Repo
https://github.com/decidim/decidim
Events
Introduced
fcac16c9eed35c9ca0ac30a3be7b962881aa06ee
Fixed
073a7d779d22458c3bb1d5b4aa6b3e41f85c338f
Database specific 
{
    "versions": [
        {
            "introduced": "0.27.0"
        },
        {
            "fixed": "0.27.3"
        }
    ]
}

Affected versions

v0.*

v0.27.0
v0.27.1
v0.27.2

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-32693.json"