CVE-2024-43415

CriticalCVSS 9.0/10Last modified Jun 17, 2026

Description

An improper neutralization of special elements used in an SQL command in the papertrail/version- model of the decidim_awesome-module <= v0.11.1 (> 0.9.0) allows an authenticated admin user to manipulate sql queries to disclose information, read and write files or execute commands.

Metrics

CVSS 3.1 9.0/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
decidim-ice	decidim-module-decidim_awesome	>= 0.9.1, < 0.10.3; >= 0.11.0, < 0.11.2
decidim_international_community_environment	decidim-module-decidim_awesome	<= 0.9.1; < 0.10.3; <= 0.11.0; < 0.11.2

References

Timeline

Published: Nov 12, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-434165.3GLPI is a free asset and IT management software package. Starting in version 0.80 and prior to version 10.0.17, an unauthenticated user can CVE-2024-434176.1GLPI is a free asset and IT management software package. An unauthenticated user can provide a malicious link to a GLPI technician in order CVE-2024-434186.1GLPI is a free asset and IT management software package. An unauthenticated user can provide a malicious link to a GLPI technician in order CVE-2024-43425.4The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's image hotspot, i CVE-2024-434205.6Exposure of sensitive information caused by shared microarchitectural predictor state that influences transient execution for some Intel Ato CVE-2024-434239.8The web application for ProGauge MAGLINK LX4 CONSOLE contains an administrative-level user account with a password that cannot be changed.CVE-2024-434247.5Sharp and Toshiba Tec MFPs improperly process HTTP request headers, resulting in an Out-of-bounds Read vulnerability. Crafted HTTP requests CVE-2024-434258.1A flaw was found in Moodle. Additional restrictions are required to avoid a remote code execution risk in calculated question types. Note: T CVE-2024-434267.5A flaw was found in pdfTeX. Insufficient sanitizing in the TeX notation filter resulted in an arbitrary file read risk on sites where pdfTeX CVE-2024-434273.7A flaw was found in moodle. When creating an export of site administration presets, some sensitive secrets and keys are not being excluded f CVE-2024-434287.1To address a cache poisoning risk in Moodle, additional validation for local storage was required.CVE-2024-434295.3A flaw was found in moodle. Some hidden user profile fields are visible in gradebook reports, which could result in users without the "view