CVE-2023-34102

CVSS V2 None CVSS V3 None

Description

Avo is an open source ruby on rails admin panel creation framework. The polymorphic field type stores the classes to operate on when updating a record with user input, and does not validate them in the back end. This can lead to unexpected behavior, remote code execution, or application crashes when viewing a manipulated record. This issue has been addressed in commit `ec117882d` which is expected to be included in subsequent releases. Users are advised to limit access to untrusted users until a new release is made.

Overview

CVE ID
CVE-2023-34102

Assigner
GitHub_M

Vulnerability Status
PUBLISHED

Published Version
2023-06-05T22:16:43.861Z

Last Modified Date
2023-06-05T22:16:43.861Z

Weakness Enumerations

CWE	URL
CWE-20	http://cwe.mitre.org/data/definitions/20.html

References

Reference URL	Reference Tags
https://github.com/avo-hq/avo/security/advisories/GHSA-86h2-2g4g-29qx	x_refsource_CONFIRM
https://github.com/avo-hq/avo/commit/ec117882ddb1b519481bdd046dc3cfa4474e6e17	x_refsource_MISC

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2023-34102
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-34102

History

Created	Old Value	New Value	Data Type	Notes
2024-06-25 20:42:21				Added to TrackCVE