Avo
Monthly
Privilege escalation in the Avo admin framework for Ruby on Rails (all 3.x versions prior to 3.31.2) lets any authenticated low-privilege user invoke arbitrary Action classes against arbitrary resources, because the ActionsController resolves actions by name across all Avo::BaseAction descendants without checking resource registration. An attacker can trigger sensitive operations such as ToggleAdmin on records they should not control, resulting in unauthorized data manipulation and role escalation across the entire application. A proof-of-concept exists in the GitHub advisory (SSVC exploitation: poc); this is no public exploit identified as actively exploited, and EPSS is low at 0.04%.
Avo is a framework to create admin panels for Ruby on Rails apps. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Avo is a framework to create admin panels for Ruby on Rails apps. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Avo is an open source ruby on rails admin panel creation framework. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Avo is an open source ruby on rails admin panel creation framework. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Privilege escalation in the Avo admin framework for Ruby on Rails (all 3.x versions prior to 3.31.2) lets any authenticated low-privilege user invoke arbitrary Action classes against arbitrary resources, because the ActionsController resolves actions by name across all Avo::BaseAction descendants without checking resource registration. An attacker can trigger sensitive operations such as ToggleAdmin on records they should not control, resulting in unauthorized data manipulation and role escalation across the entire application. A proof-of-concept exists in the GitHub advisory (SSVC exploitation: poc); this is no public exploit identified as actively exploited, and EPSS is low at 0.04%.
Avo is a framework to create admin panels for Ruby on Rails apps. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Avo is a framework to create admin panels for Ruby on Rails apps. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Avo is an open source ruby on rails admin panel creation framework. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Avo is an open source ruby on rails admin panel creation framework. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.