CVE-2023-34103

HighCVSS 7.3

Published: 05/06/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.56%

42th percentile - higher than 42% of all known CVEs

Summary

Avo is an open source ruby on rails admin panel creation framework that is vulnerable to Cross Site Scripting (XSS) in affected versions when rendering HTML based content. Attackers need form edit privilege to successfully exploit this vulnerability.

Risk Assessment

This vulnerability may lead to session hijacking or data theft, posing a serious threat to the security of the application and its users.

Recommendation

It is advised to configure CSP headers for the application and to limit untrusted user access as a mitigation.

Other vulnerabilities in Avo framework

CVE-2023-34102High
Avo is a Ruby on Rails admin panel creation framework that does not validate polymorphic field types in the backend. This can lead to unexpected behavior, remote code execution, or application crashes when viewing a manipulated record.

Original NVD description (English source)

Avo is an open source ruby on rails admin panel creation framework. In affected versions some avo fields are vulnerable to Cross Site Scripting (XSS) when rendering html based content. Attackers do need form edit privilege in order to successfully exploit this vulnerability, but the results are stored and no specific timing is required. This issue has been addressed in commit `7891c01e` which is expected to be included in the next release of avo. Users are advised to configure CSP headers for their application and to limit untrusted user access as a mitigation.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS