CVE-2024-22191

Public Exploit
Stored cross-site scripting (XSS) in `key_value` field in Avo

Description

Avo is a framework to create admin panels for Ruby on Rails apps. A stored cross-site scripting (XSS) vulnerability was found in the key_value field of Avo v3.2.3 and v2.46.0. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the victim's browser. The value of the key_value is inserted directly into the HTML code. In the current version of Avo (possibly also older versions), the value is not properly sanitized before it is inserted into the HTML code. This vulnerability could be used to steal sensitive information from victims that could be used to hijack victims' accounts or redirect them to malicious websites. Avo 3.2.4 and 2.47.0 include a fix for this issue. Users are advised to upgrade.

Category

7.3
CVSS
Severity: High
CVSS 3.1 •
EPSS 0.71% Top 30%
Vendor Advisory github.com
Affected: avo-hq avo
Published at:
Updated at:

References

Link Tags
https://github.com/avo-hq/avo/security/advisories/GHSA-ghjv-mh6x-7q6h vendor advisory exploit
https://github.com/avo-hq/avo/commit/51bb80b181cd8e31744bdc4e7f9b501c81172347 patch
https://github.com/avo-hq/avo/commit/fc92a05a8556b1787c8694643286a1afa6a71258 patch

Frequently Asked Questions

What is the severity of CVE-2024-22191?
CVE-2024-22191 has been scored as a high severity vulnerability.
How to fix CVE-2024-22191?
To fix CVE-2024-22191, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2024-22191 being actively exploited in the wild?
It is possible that CVE-2024-22191 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~1% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2024-22191?
CVE-2024-22191 affects avo-hq avo.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.