CVE-2024-22191
Stored cross-site scripting (XSS) in `key_value` field in Avo
- Published
- Updated
- Reserved
- Assigned by
- GitHub_M
Description
Avo is a framework to create admin panels for Ruby on Rails apps. A stored cross-site scripting (XSS) vulnerability was found in the key_value field of Avo v3.2.3 and v2.46.0. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the victim's browser. The value of the key_value is inserted directly into the HTML code. In the current version of Avo (possibly also older versions), the value is not properly sanitized before it is inserted into the HTML code. This vulnerability could be used to steal sensitive information from victims that could be used to hijack victims' accounts or redirect them to malicious websites. Avo 3.2.4 and 2.47.0 include a fix for this issue. Users are advised to upgrade.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| GitHub_MCNA (assigner) | 3.1 | High7.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N |
| NVDNVD · Modified | 3.1 | Medium5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
- EPSS (exploitation in 30 days)
- 0.74% · top 45% of all CVEs (7 Nov 2026)
- CISA SSVC
- Exploitation: poc · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.3.
Weakness
Affected products
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- RubyGemsavoGHSA-ghjv-mh6x-7q6h (opens in a new tab)
References (3)
- https://github.com/avo-hq/avo/security/advisories/GHSA-ghjv-mh6x-7q6h (opens in a new tab)x_refsource_CONFIRMx_transferred
- https://github.com/avo-hq/avo/commit/51bb80b181cd8e31744bdc4e7f9b501c81172347 (opens in a new tab)x_refsource_MISCx_transferred
- https://github.com/avo-hq/avo/commit/fc92a05a8556b1787c8694643286a1afa6a71258 (opens in a new tab)x_refsource_MISCx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-ghjv-mh6x-7q6h (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2024-22191)Record last updated .