Stored cross-site scripting (XSS) in `key_value` field in Avo
CVE-2024-22191
7.3HIGH
What is CVE-2024-22191?
Avo, a popular framework for creating admin panels in Ruby on Rails applications, has a stored cross-site scripting (XSS) vulnerability affecting versions v3.2.3 and v2.46.0. This vulnerability arises from improper sanitization of the key_value field, allowing malicious users to inject arbitrary JavaScript code into the browser of anyone accessing the admin interface. Attackers can exploit this flaw to steal sensitive information or manipulate session data, potentially leading to account hijacking or redirection to harmful websites. Users are strongly advised to upgrade to Avo v3.2.4 or v2.47.0, which contain patches addressing this security issue.
Affected Version(s)
avo >= 3.0.0.beta1, < 3.2.4 < 3.0.0.beta1, 3.2.4
avo < 2.47.0 < 2.47.0