Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| decidim-demographics | rubygems | >= 0.31.0, < 0.31.5 | 0.31.5 |
| decidim-demographics | rubygems | >= 0.32.0.rc1, < 0.32.0 | 0.32.0 |
Miggo AIRoot Cause AnalysisThe vulnerability lies in the decidim-forms module, specifically within the HasQuestionnaire concern that is used by other controllers for managing questionnaires. The analysis of the provided patch in commit f70465ef3fe4173db1aa9f0d96cfcab037729511 reveals that the edit_questions and update_questions methods were missing authorization checks. The vulnerability description mentions that the /admin/demographics/questions/edit_questions route was accessible to non-admins. This route is handled by the Decidim::Demographics::Admin::QuestionsController, which includes the Decidim::Forms::Admin::Concerns::HasQuestionnaire concern. Before the patch, the edit_questions and update_questions methods in this concern did not enforce any permissions, allowing any logged-in user to view and modify the questionnaire. The patch rectifies this by adding a call to enforce_permission_to in both methods, ensuring that only users with the appropriate permissions can access these administrative functions.
Decidim::Forms::Admin::Concerns::HasQuestionnaire.edit_questionsdecidim-forms/app/controllers/decidim/forms/admin/concerns/has_questionnaire.rb
Decidim::Forms::Admin::Concerns::HasQuestionnaire.update_questionsdecidim-forms/app/controllers/decidim/forms/admin/concerns/has_questionnaire.rb