CVE-2023-34103 Stored XSS (Cross Site Scripting) in html content based fields of avo
Attackers with form edit privileges can inject malicious scripts into HTML fields, leading to stored XSS attacks against other users.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-34103?
CVE-2023-34103 is a high-severity cross-site scripting vulnerability in avo-hq avo, published on 5 Jun 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Avo is an open source ruby on rails admin panel creation framework. In affected versions some avo fields are vulnerable to Cross Site Scripting (XSS) when rendering html based content. Attackers do need form edit privilege in order to successfully exploit this vulnerability, but the results are stored and no specific timing is required. This issue has been addressed in commit `7891c01e` which is expected to be included in the next release of avo. Users are advised to configure CSP headers for their application and to limit untrusted user access as a mitigation.
Weakness: CWE-79
Which versions are affected by CVE-2023-34103?
4 open source packages ship an affected version, including avo. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
avo RubyGems | All versions | 2.33.3 |
avo RubyGems | All versions | 2.33.3 |
avo RubyGems | From 3.0.0.pre1 to 3.0.0.pre12 | None |
avo RubyGems | From 3.0.0.pre1 to 3.0.0.pre12 | None |
Products include Avohq Avo.
How do I fix CVE-2023-34103?
Upgrade avo to 2.33.3 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2023-34103 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-34103 exists.
Other vulnerabilities in avo-hq avo
Sources
Also known as GHSA-5cr9-5jx3-2g39.