Skip to main content

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-22191

Medium
5.4/10

Summary

Avo is a framework for creating admin panels for Ruby on Rails apps. A stored Cross-site Scripting (XSS) vulnerability was found in the "key_value" field of avo package versions 1.3.5.pre.1 through 2.46.0, 3.0.0.beta1 through 3.2.3, and in 1.3.0.pre.1 version. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the victim's browser. The value of the "key_value" is inserted directly into the HTML code. In the current version of Avo (possibly also older versions), the value is not properly sanitized before it is inserted into the HTML code. This vulnerability could be used to steal sensitive information from victims that could be used to hijack victims' accounts or redirect them to malicious websites. Users are advised to upgrade.

  • LOW
  • NETWORK
  • LOW
  • CHANGED
  • REQUIRED
  • LOW
  • LOW
  • NONE

CWE-79 - Cross Site Scripting

Cross-Site Scripting, commonly referred to as XSS, is the most dominant class of vulnerabilities. It allows an attacker to inject malicious code into a pregnable web application and victimize its users. The exploitation of such a weakness can cause severe issues such as account takeover, and sensitive data exfiltration. Because of the prevalence of XSS vulnerabilities and their high rate of exploitation, it has remained in the OWASP top 10 vulnerabilities for years.

References

Advisory Timeline

  • Published