← back
CVE-2024-37031

CVE-2024-37031

CVSS 6.1 MEDIUMEPSS 0.3%CWE-79
The Active Admin (aka activeadmin) framework before 3.2.2 for Ruby on Rails allows stored XSS in certain situations where users can create entities (to be later edited in forms) with arbitrary names, aka a "dynamic form legends" issue. 4.0.0.beta7 is also a fixed version.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products
n/a · n/a

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
https://github.com/activeadmin/activeadmin/releases/tag/v3.2.2https://github.com/activeadmin/activeadmin/security/advisories/GHSA-9mg6-x45v-hcfmhttps://rubygems.org/gems/activeadmin/versions/3.2.2