Executive brief
Decidim is an open-source platform for citizen participation and democratic governance. A security vulnerability in its meeting module allows attackers to inject malicious scripts into online or hybrid meeting pages. If exploited, this could allow an attacker to perform unauthorized actions on behalf of users or steal sensitive session information when a user views a specially crafted meeting link.
Technical details
A Cross-Site Scripting (XSS) vulnerability exists in the decidim-meetings component of the Decidim participation framework. The flaw is located within the meeting embeds feature used for online or hybrid meetings, where the application fails to properly neutralize input in URLs before rendering them in the browser. An attacker with low privileges can exploit this by providing a malformed URL that, when visited by another user, executes arbitrary JavaScript in the context of that user's session. This can lead to session hijacking or unauthorized data modification. The vulnerability is patched in version 0.28.3; a workaround is to disable meeting creation by participants.
Affected products
- Decidim decidim-meetings >= 0.28.0, < 0.28.3
Timeline
- 2024-11-13: advisory: GitHub Advisory GHSA-j4h6-gcj7-7v9v published
- 2024-11-13: patched: Version 0.28.3 released