CVE-2023-36465: Decidim has broken access control in templates
Impact
The templates module doesn't enforce the correct permissions, allowing any logged-in user to access to this functionality in the administration panel. An attacker could use this vulnerability to change, create or delete templates of surveys.
Other sources
Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. The templates module doesn't enforce the correct permissions, allowing any logged-in user to access to this functionality in the administration panel. An attacker could use this vulnerability to change, create or delete templates of surveys. This issue has been patched in version 0.26.8 and 0.27.4.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the impact of CVE-2023-36465?
The impact of CVE-2023-36465 is that the `templates` module in Decidim doesn't enforce correct permissions, allowing any logged-in user to access and modify templates of surveys.
How can an attacker exploit CVE-2023-36465?
An attacker can exploit CVE-2023-36465 by leveraging the lack of proper permissions enforcement in the `templates` module to change, create, or delete templates of surveys.
Which versions of Decidim are affected by CVE-2023-36465?
Versions 0.23.2 to 0.26.8 of Decidim and Decidim Templates, up to version 0.27.4, are affected by CVE-2023-36465.
What is the severity level of CVE-2023-36465?
CVE-2023-36465 has a severity level of 9.1, which is classified as critical.
How can I fix the vulnerability CVE-2023-36465?
To fix the vulnerability CVE-2023-36465, update Decidim and Decidim Templates to version 0.27.4 or apply the remedy provided.