Avo is a framework to create admin panels for Ruby on Rails apps. In Avo 3 pre12, any HTML inside text that is passed to `error` or `succeed` in an `Avo::BaseAction` subclass will be rendered directly without sanitization in the toast/notification that appears in the UI on Action completion. A malicious user could exploit this vulnerability to trigger a cross site scripting attack on an unsuspecting user. This issue has been addressed in the 3.3.0 and 2.47.0 releases of Avo. Users are advised to upgrade.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Avohq |
|
Configuration 1 [-]
|
No data.
No data.
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2024-0353 | Avo is a framework to create admin panels for Ruby on Rails apps. In Avo 3 pre12, any HTML inside text that is passed to `error` or `succeed` in an `Avo::BaseAction` subclass will be rendered directly without sanitization in the toast/notification that appears in the UI on Action completion. A malicious user could exploit this vulnerability to trigger a cross site scripting attack on an unsuspecting user. This issue has been addressed in the 3.3.0 and 2.47.0 releases of Avo. Users are advised to upgrade. |
 Github GHSA |
GHSA-g8vp-2v5p-9qfh | Cross-site scripting (XSS) in Action messages on Avo |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Mon, 02 Jun 2025 20:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2025-06-02T15:07:11.491Z
Reserved: 2024-01-10T15:09:55.550Z
Link: CVE-2024-22411
Vulnrichment
Updated: 2024-08-01T22:43:34.946Z
NVD
Status : Modified
Published: 2024-01-16T22:15:46.420
Modified: 2024-11-21T08:56:13.933
Link: CVE-2024-22411
Redhat
No data.
OpenCVE Enrichment
No data.