Cross-site scripting (XSS) in Action messages on Avo

中 5.4CVE-2024-22411 · GHSA-g8vp-2v5p-9qfh · 16/01/2024 公開 · 17/06/2026 更新

要点

CVE-2024-22411 は avo, avo (avohq) に影響する深刻度「中」 (CVSS 5.4) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.71%（全脆弱性の 53.6% より高い）。
対処：3.3.0, 2.47.0 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
avo RubyGems	`≥ 3.0.0.beta1, < 3.3.0< 2.47.0`	`3.3.02.47.0`
avo avohq	`= 3.0.0≥ 3.0.2, < 3.3.0< 2.47.0`	`3.3.02.47.0`

概要

Avo is a framework to create admin panels for Ruby on Rails apps. In Avo 3 pre12, any HTML inside text that is passed to error or succeed in an Avo::BaseAction subclass will be rendered directly without sanitization in the toast/notification that appears in the UI on Action completion. A malicious user could exploit this vulnerability to trigger a cross site scripting attack on an unsuspecting user. This issue has been addressed in the 3.3.0 and 2.47.0 releases of Avo. Users are advised to upgrade.

NVD の説明

Avo is a framework to create admin panels for Ruby on Rails apps. In Avo 3 pre12, any HTML inside text that is passed to `error` or `succeed` in an `Avo::BaseAction` subclass will be rendered directly without sanitization in the toast/notification that appears in the UI on Action completion. A malicious user could exploit this vulnerability to trigger a cross site scripting attack on an unsuspecting user. This issue has been addressed in the 3.3.0 and 2.47.0 releases of Avo. Users are advised to upgrade.