PT-2024-19264 · Avo · Avo

Mys7Ic · Published 2024-01-16 · Updated 2024-01-24 · CVE-2024-22191

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Avo versions 2.46.0 through 3.2.3

Description A stored cross-site scripting (XSS) vulnerability was found in the key value field of Avo. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the victim's browser. The value of the key value is inserted directly into the HTML code and is not properly sanitized before it is inserted into the HTML code. This vulnerability could be used to steal sensitive information from victims that could be used to hijack victims' accounts or redirect them to malicious websites.

Recommendations For Avo versions 2.46.0 through 3.2.3, upgrade to version 3.2.4 or 2.47.0 to resolve the issue. As a temporary workaround, consider disabling the key value field until a patch is available. Restrict access to the key value field to minimize the risk of exploitation. Avoid using the key value field in the affected Avo versions until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-22191

GHSA-GHJV-MH6X-7Q6H

Affected Products

Avo

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/22xxx/CVE-2024-22191.json · Exploit
• 🔥 https://github.com/avo-hq/avo/security/advisories/GHSA-ghjv-mh6x-7q6h · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/avo/CVE-2024-22191.yml · Exploit
• https://github.com/avo-hq/avo/commit/51bb80b181cd8e31744bdc4e7f9b501c81172347 · Patch
• https://github.com/avo-hq/avo/commit/fc92a05a8556b1787c8694643286a1afa6a71258 · Patch
• https://osv.dev/vulnerability/GHSA-ghjv-mh6x-7q6h · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-22191 · Security Note
• https://osv.dev/vulnerability/CVE-2024-22191 · Vendor Advisory
• https://github.com/avo-hq/avo · Note
• https://twitter.com/VulmonFeeds/status/1747404233802936489 · Twitter Post
• https://twitter.com/rubylandnews/status/1747791087882682439 · Twitter Post
• https://twitter.com/CVEnew/status/1747386035263213728 · Twitter Post
• https://t.me/cvenotify/68571 · Telegram Post
• https://twitter.com/it_malibu/status/1747806034914390381 · Twitter Post