CVE-2023-34090

Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. Decidim uses a third-party library named Ransack for filtering certain database collections (e.g., public meetings). By default, this library allows filtering on all data attributes and associations. This allows an unauthenticated remote attacker to exfiltrate non-public data from the underlying database of a Decidim instance (e.g., exfiltrating data from the user table). This issue may lead to Sensitive Data Disclosure. The problem was patched in version 0.27.3.

Affected products

Decidim, Ransack, Ruby On Rails

Decidim

< 0.27.3

Fix

Available

CVSS 3.1

7.5 HIGH

EPSS

1.2% (66th percentile)

Weakness

CWE-200

NVD status

Modified

Published

2023-07-11

No exploit for CVE-2023-34090 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.