CVE-2024-32034
Decidim::Admin vulnerable to cross-site scripting (XSS) in the admin activity log
Summary
Remediation
Upgrade to the fixed version using your package manager.
gem install decidim-admin -v 0.28.2
gem install decidim-admin -v 0.27.7
After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.
Affected Packages (2)
| Package | Ecosystem | Affected | Fixed In |
|---|---|---|---|
| decidim-admin | rubygems | 0.28.0, 0.28.1 | 0.28.2 |
| decidim-admin | rubygems | 0.0.1, 0.0.1.alpha3, 0.0.1.alpha4, 0.0.1.alpha5 (+119 more) | 0.27.7 |
Vulnerability Classification
Common Weakness Enumeration (CWE) identifiers for this vulnerability type.
- CWE-79Cross-site Scripting (XSS)MITRE
CVSS Score Breakdown
What the CVSS (Common Vulnerability Scoring System) 6.8 score means for each attack dimension.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
References
- https://github.com/decidim/decidim/security/advisories/GHSA-rx9f-5ggv-5rh6WEB
- https://nvd.nist.gov/vuln/detail/CVE-2024-32034ADVISORY
- https://github.com/decidim/decidim/commit/23fc8d702a4976727f78617f5e42353d67931645WEB
- https://github.com/decidim/decidim/commit/9d79f09a2d38c87feb28725670d6cc1f55c22072WEB
- https://github.com/decidim/decidim/commit/e494235d559be13dd1f8694345e6f6bba762d1c0WEB
- https://github.com/decidim/decidim/commit/ff755e23814aeb56e9089fc08006a5d3faee47b6WEB
- https://github.com/decidim/decidimPACKAGE
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim-admin/CVE-2024-32034.ymlWEB
Frequently Asked Questions
- What is CVE-2024-32034?
- Decidim::Admin vulnerable to cross-site scripting (XSS) in the admin activity log This vulnerability has been assigned a severity rating of MEDIUM (CVSS score: 6.8/10).
- How do I check if my project is affected by CVE-2024-32034?
- CVE-2024-32034 affects decidim-admin. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2024-32034 and 200,000+ other known vulnerabilities.
Severity & Exploitability
Exploitation requires specific conditions or has limited impact. Remediate within weeks.
Also Known As
Related CVEs
- CVE-2026-71437MEDIUM
Mermaid Architecture diagrams are vulnerable to prototype pollution
- CVE-2024-27095MEDIUM
Decidim cross-site scripting (XSS) in the admin panel
- CVE-2026-62909MEDIUM
Microsoft Security Advisory CVE-2026-62909 – .NET Elevation of Privilege Vulnerability
- CVE-2026-62902MEDIUM
Microsoft Security Advisory CVE-2026-62902 – .NET Information Disclosure Vulnerability
- CVE-2026-61807MEDIUM
Snipe-IT: Stored DOM XSS via table selected-count IDs
- CVE-2026-45376MEDIUM
Decidim: Admin user search allows SQL injection through similarity-based sorting
- CVE-2026-62899MEDIUM
Microsoft Security Advisory CVE-2026-62899 – .NET Security Feature Bypass Vulnerability
- CVE-2023-48220MEDIUM
Possibility to circumvent the invitation token expiry period
Check if you're affected
Scan your dependencies to see if this vulnerability affects your projects.
Scan Your Dependencies