CVE-2024-45594

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Decidim is a participatory democracy framework. The meeting embeds feature used in the online or hybrid meetings is subject to potential XSS attack through a malformed URL. This vulnerability is fixed in 0.28.3 and 0.29.0.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
decidim	decidim	>= 0.28.0, < 0.28.3
decidim	decidim	0.28.0; 0.28.1; 0.28.2

References

https://github.com/decidim/decidim/security/advisories/GHSA-j4h6-gcj7-7v9vThird Party Advisory

Timeline

Published: Nov 13, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-455959.8D-Tale is a visualizer for Pandas data structures. Users hosting D-Tale publicly can be vulnerable to remote code execution allowing attacke CVE-2024-455966.5Directus is a real-time API and App dashboard for managing SQL database content. An unauthenticated user can access credentials of last auth CVE-2024-455975.3Pluto is a superset of Lua 5.4 with a focus on general-purpose programming. Scripts passing user-controlled values to http.request header va CVE-2024-455984.9Cacti is an open source performance and fault management framework. Prior to 1.2.29, an administrator can change the `Poller Standard Error CVE-2024-455993.8Cursor is an artificial intelligence code editor. Prior to version 0.41.0, if a user on macOS has granted Cursor access to the camera or mic CVE-2024-45609.8The Kognetiks Chatbot for WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the CVE-2024-456007.7Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms. Prior to 1.21.13, an authenticated user can perform a SQ CVE-2024-456017.5Mesop is a Python-based UI framework designed for rapid web apps development. A vulnerability has been discovered and fixed in Mesop that co CVE-2024-456044.3Contao is an Open Source CMS. In affected versions authenticated users in the back end can list files outside the document root in the file CVE-2024-456054.3Sentry is a developer-first error tracking and performance monitoring platform. An authenticated user delete the user issue alert notificati CVE-2024-456064.3Sentry is a developer-first error tracking and performance monitoring platform. An authenticated user can mute alert rules from arbitrary or CVE-2024-456075.3whatsapp-api-js is a TypeScript server agnostic Whatsapp's Official API framework. It's possible to check the payload validation using the W