Executive brief
Decidim vulnerable to data disclosure through the embed feature
Affected products
- RubyGems decidim
Junglewise Threat Intelligence
CVE-2024-27090: Decidim vulnerable to data disclosure through the embed feature
CVE-2024-27090 · Severity: low · CVSS 3.1 · Published 2024-07-10
Technologies: decidim (RubyGems). Vendors: RubyGems.
Related threats
- Decidim's private data exports can lead to data leaks
- Decidim has a cross-site scripting vulnerability in the version control page
- Decidim::Admin vulnerable to cross-site scripting (XSS) in the admin panel with QuillJS WYSWYG editor
- Cross-site scripting (XSS) in the dynamic file uploads
- Decidim vulnerable to sensitive data disclosure