XSS in Avo-Hq Avo
CVE-2023-34103
Avo is an open source ruby on rails admin panel creation framework. In affected versions some avo fields are vulnerable to Cross Site Scripting (XSS) when rendering html based content. Attackers do need form edit privilege in order to successfully exploit this vulnerability, but the results are stored and no specific timing is required. This issue has been addressed in commit `7891c01e` which is expected to be included in the next release of avo. Users are advised to configure CSP headers for their application and to limit untrusted user access as a mitigation.
Vulnerability class: XSS (Cross-Site Scripting)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.3 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N.
EPSS exploit prediction
EPSS: 0.006 (44.6th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 45th percentile — 44.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.006 · newest: 0.006 · change: 0.000
Affected products
- Avo-Hq Avo — versions <= 2.33.2, >= 3.0.0.pre1, <= 3.0.0.pre12
- Avohq Avo — versions 3.0.0
Weakness classification (CWE)
References
- github.com/avo-hq/avo/security/advisories/GHSA-5cr9-5jx3-2g39 (Exploit, Vendor Advisory)
- github.com/avo-hq/avo/commit/7891c01e1fba9ca5d7dbccc43d27f385e5d08563 (Patch)
Frequently asked questions
- What is CVE-2023-34103?
- CVE-2023-34103 is a high-severity vulnerability in Avo-Hq Avo, classified under Cross-site Scripting. CVSS score: 7.3/10. Published 2023-06-05.
- How severe is CVE-2023-34103?
- High severity. CVSS v3 base score is 7.3 out of 10.