CVE-2023-48220

HIGH EPSS 51.7%
Published Feb 20, 20242y ago · Modified Jun 17, 20262w ago
7.4 CVSS 3.1
High
Find Similar
Published Feb 20, 2024 2y ago
Last Modified Jun 17, 2026 2w ago

Description

Decidim is a participatory democracy framework. Starting in version 0.4.rc3 and prior to version 2.0.9 of the `devise_invitable` gem, the invites feature allows users to accept the invitation for an unlimited amount of time through the password reset functionality. This issue creates vulnerable dependencies starting in version 0.0.1.alpha3 and prior to versions 0.26.9, 0.27.5, and 0.28.0 of the `decidim,` `decidim-admin`, and `decidim-system` gems. When using the password reset functionality, the `devise_invitable` gem always accepts the pending invitation if the user has been invited. The only check done is if the user has been invited but the code does not ensure that the pending invitation is still valid as defined by the `invite_for` expiry period. Decidim sets this configuration to `2.weeks` so this configuration should be respected. The bug is in the `devise_invitable` gem and should be fixed there and the dependency should be upgraded in Decidim once the fix becomes available. `devise_invitable` to version `2.0.9` and above fix this issue. Versions 0.26.9, 0.27.5, and 0.28.0 of the `decidim,` `decidim-admin`, and `decidim-system` gems contain this fix. As a workaround, invitations can be cancelled directly from the database.

CVSS Details

Base Score
7.4
Exploitability
2.2
Impact
5.2
Vector string
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack Vector Network
Attack Complexity High
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability None

Threat Intelligence

EPSS Exploit Probability
51.7% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-672

Affected Products 15

VendorProductVersionRange
decidimdecidim*≥0.0.2  –  <0.26.9
decidimdecidim*≥0.27.0  –  <0.27.5
decidimdecidim0.0.1any
decidimdecidim0.0.1any
decidimdecidim0.0.1any
decidimdecidim0.0.1any
decidimdecidim0.0.1any
decidimdecidim0.0.1any
decidimdecidim0.0.1any
decidimdecidim0.0.1any
scambradevise_invitable*≥0.4.1  –  <2.0.9
scambradevise_invitable0.4.0any
scambradevise_invitable0.4.0any
scambradevise_invitable0.4.0any
scambradevise_invitable0.4.0any

References 9

  • github.com https://github.com/decidim/decidim/blob/d2d390578050772d1bdb6d731395f1afc39dcbfc/decidim-core/config/initializers/devise.rb#L134
    Product
  • github.com https://github.com/decidim/decidim/commit/073e60e2e4224dd81815a784002ebba30f2ebb34
    Patch
  • github.com https://github.com/decidim/decidim/commit/b12800717a689c295a9ea680a38ca9f823d2c454
    Patch
  • github.com https://github.com/decidim/decidim/releases/tag/v0.26.9
    Release Notes
  • github.com https://github.com/decidim/decidim/releases/tag/v0.27.5
    Release Notes
  • github.com https://github.com/decidim/decidim/releases/tag/v0.28.0
    Release Notes
  • github.com https://github.com/decidim/decidim/security/advisories/GHSA-w3q8-m492-4pwp
    MitigationPatchVendor Advisory
  • github.com https://github.com/scambra/devise_invitable/blob/41f58970ff76fb64382a9b9ea1bd530f7c3adab2/lib/devise_invitable/models.rb#L198
    Product
  • github.com https://github.com/scambra/devise_invitable/commit/94d859c7de0829bf63f679ae5dd3cab2b866a098
    Patch

Remediation

  • github.com https://github.com/decidim/decidim/commit/073e60e2e4224dd81815a784002ebba30f2ebb34
    Patch
  • github.com https://github.com/decidim/decidim/commit/b12800717a689c295a9ea680a38ca9f823d2c454
    Patch
  • github.com https://github.com/decidim/decidim/security/advisories/GHSA-w3q8-m492-4pwp
    MitigationPatchVendor Advisory
  • github.com https://github.com/scambra/devise_invitable/commit/94d859c7de0829bf63f679ae5dd3cab2b866a098
    Patch