Is CVE-2024-45594 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-45594 being exploited in the wild.

How severe is CVE-2024-45594?

High severity, with a CVSS score of 7.7, published 13 November 2024.

Which products and versions are affected?

Decidim Meetings >= 0.28.0, = 0.28.0, < 0.28.3, ECOSYSTEM:introduced=0.28.0,fixed=0.28.3.

Is there a fix for CVE-2024-45594?

Yes. decidim-meetings (RubyGems): upgrade to 0.28.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-45594 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2024-45594?

Check whether you run Decidim Meetings or decidim-meetings (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-45594: Decidim decidim-meetings XSS in meeting embeds

Q: Is there a fix for CVE-2024-45594?

Yes. decidim-meetings (RubyGems): upgrade to 0.28.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2024-45594 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2024-45594?

Check whether you run Decidim Meetings or decidim-meetings (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-45594 · Severity: high · CVSS 7.7 · Published 2024-11-13

Decidim is an open-source platform for citizen participation and democratic governance. A security vulnerability in its meeting module allows attackers to inject malicious scripts into online or hybrid meeting pages. If exploited, this could allow an attacker to perform unauthorized actions on behalf of users or steal sensitive session information when a user views a specially crafted meeting link.

Vendors: Decidim, RubyGems.

Quick answers

Is CVE-2024-45594 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-45594 being exploited in the wild.
How severe is CVE-2024-45594?: High severity, with a CVSS score of 7.7, published 13 November 2024.
Which products and versions are affected?: Decidim Meetings >= 0.28.0, < 0.28.3; decidim-meetings (RubyGems) >= 0.28.0, < 0.28.3, ECOSYSTEM:introduced=0.28.0,fixed=0.28.3.
Is there a fix for CVE-2024-45594?: Yes. decidim-meetings (RubyGems): upgrade to 0.28.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-45594 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2024-45594?: Check whether you run Decidim Meetings or decidim-meetings (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

decidim-meetings (RubyGems): upgrade to 0.28.3 or later
```
bundle update decidim-meetings
```

Technical details

A Cross-Site Scripting (XSS) vulnerability exists in the decidim-meetings component of the Decidim participation framework. The flaw is located within the meeting embeds feature used for online or hybrid meetings, where the application fails to properly neutralize input in URLs before rendering them in the browser. An attacker with low privileges can exploit this by providing a malformed URL that, when visited by another user, executes arbitrary JavaScript in the context of that user's session. This can lead to session hijacking or unauthorized data modification. The vulnerability is patched in version 0.28.3; a workaround is to disable meeting creation by participants.

Affected products

Decidim decidim-meetings >= 0.28.0, < 0.28.3

Identifiers

CVE-2024-45594
GHSA-j4h6-gcj7-7v9v

Timeline

2024-11-13: advisory: GitHub Advisory GHSA-j4h6-gcj7-7v9v published
2024-11-13: patched: Version 0.28.3 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.