CVE-2024-22191

Summary

CVE-2024-22191 is a stored cross-site scripting (XSS) vulnerability affecting versions 3.2.3 and 2.46.0 of the Avo framework, used for creating admin panels in Ruby on Rails applications. The vulnerability lies in the key_value field, which is inserted directly into HTML code without proper sanitization. An attacker can exploit this issue to execute arbitrary JavaScript code in the victim's browser, potentially leading to account hijacking or redirection to malicious sites. Users are urged to upgrade to Avo versions 3.2.4 and 2.47.0, which address this security concern.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.