Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2023-34102— Possible unsafe reflection / partial denial of service in avo

Quick assessment

Affected
avo-hq avo
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Avo是Avo开源的一个开源的 ruby on rails 管理面板创建框架。 Avo 2.33.2版本、3.0.0.pre12版本存在输入验证错误漏洞，该漏洞源于用户在使用多态字段类型存储输入并更新记录类时，不会在后端验证，这可能导致远程代码执行、应用程序崩溃。

CVSS 8.3 · High EPSS 1.61% · P74

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2023-34102

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Possible unsafe reflection / partial denial of service in avo
Source: CVE Program / CVE List V5
Vulnerability Description
Avo is an open source ruby on rails admin panel creation framework. The polymorphic field type stores the classes to operate on when updating a record with user input, and does not validate them in the back end. This can lead to unexpected behavior, remote code execution, or application crashes when viewing a manipulated record. This issue has been addressed in commit `ec117882d` which is expected to be included in subsequent releases. Users are advised to limit access to untrusted users until a new release is made.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
输入验证不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
Avo 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Avo是Avo开源的一个开源的 ruby on rails 管理面板创建框架。 Avo 2.33.2版本、3.0.0.pre12版本存在输入验证错误漏洞，该漏洞源于用户在使用多态字段类型存储输入并更新记录类时，不会在后端验证，这可能导致远程代码执行、应用程序崩溃。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
avo-hq avo <= 2.33.2 -

II. Public POCs for CVE-2023-34102

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2023-34102

请登录查看更多情报信息。

Patches & Fixes for CVE-2023-34102 (1)

Vendor Advisories for CVE-2023-34102 (1)

IV. Related Vulnerabilities

Same product: avo
Same vendor: avo-hq
Same weakness: CWE-20

V. Comments for CVE-2023-34102

No comments yet

Leave a comment