CVE-2024-22411

CVSS V2 None CVSS V3 None
Description
Avo is a framework to create admin panels for Ruby on Rails apps. In Avo 3 pre12, any HTML inside text that is passed to `error` or `succeed` in an `Avo::BaseAction` subclass will be rendered directly without sanitization in the toast/notification that appears in the UI on Action completion. A malicious user could exploit this vulnerability to trigger a cross site scripting attack on an unsuspecting user. This issue has been addressed in the 3.3.0 and 2.47.0 releases of Avo. Users are advised to upgrade.
Overview
  • CVE ID
  • CVE-2024-22411
  • Assigner
  • GitHub_M
  • Vulnerability Status
  • PUBLISHED
  • Published Version
  • 2024-01-16T21:57:44.824Z
  • Last Modified Date
  • 2024-01-19T17:24:40.497Z
History
Created Old Value New Value Data Type Notes
2024-06-26 09:18:24 Added to TrackCVE