CVE-2024-22191

Katalog CVE

CVSS 5.4 · Medium EPSS 0,75%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada avohq avo. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

Avo is a framework to create admin panels for Ruby on Rails apps. A stored cross-site scripting (XSS) vulnerability was found in the key_value field of Avo v3.2.3 and v2.46.0. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the victim's browser. The value of the key_value is inserted directly into the HTML code. In the current version of Avo (possibly also older versions), the value is not properly sanitized before it is inserted into the HTML code. This vulnerability could be used to steal sensitive information from victims that could be used to hijack victims' accounts or redirect them to malicious websites. Avo 3.2.4 and 2.47.0 include a fix for this issue. Users are advised to upgrade.

Rincian

Terbit di NVD

16 Januari 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,75% peluang dieksploitasi; lebih tinggi dari 53,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/avo-hq/avo/security/advisories/GHSA-ghjv-mh6x-7q6h exploit · advisory vendor
• https://github.com/avo-hq/avo/commit/51bb80b181cd8e31744bdc4e7f9b501c81172347 patch
• https://github.com/avo-hq/avo/commit/fc92a05a8556b1787c8694643286a1afa6a71258 patch