CVE-2023-34102highCWE-20

CVE-2023-34102: falha de alta gravidade em avo-hq avo

Possible unsafe reflection / partial denial of service in avo

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar avo+ Monitorar avo

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.3epss 1.6%
Avo is an open source ruby on rails admin panel creation framework. The polymorphic field type stores the classes to operate on when updating a record with user input, and does not validate them in the back end. This can lead to unexpected behavior, remote code execution, or application crashes when viewing a manipulated record. This issue has been addressed in commit `ec117882d` which is expected to be included in subsequent releases. Users are advised to limit access to untrusted users until a new release is made.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
Produtos afetados
avo-hq · avo
CVEs relacionadas — avo-hq avo

No mesmo produto, das mais perigosas para as menos.

CVE-2024-22191HIGHStored cross-site scripting (XSS) in `key_value` field in AvoEPSS 0.7%CVE-2024-22411MEDIUMCross site scripting in Action messages on AvoEPSS 0.7%CVE-2023-34103HIGHStored XSS (Cross Site Scripting) in html content based fields of avoEPSS 0.6%CVE-2026-53769MEDIUMAvo: Direct attachment upload endpoint lacks upload authorization and bypasses field-level upload policyEPSS 0.4%CVE-2026-55518CRITICALAvo: Missing Authorization in Avo Association Attach Endpoint Allows Unauthorized Relationship Manipulation and Privilege EscalationEPSS 0.4%CVE-2026-42205HIGHAvo: Broken Access Control: Unauthorized Execution of Arbitrary Action Classes Across ResourcesEPSS 0.3%