The Active Admin (aka activeadmin) framework before 3.2.2 for Ruby on Rails allows stored XSS in certain situations where users can create entities (to be later edited in forms) with arbitrary names, aka a "dynamic form legends" issue. 4.0.0.beta7 is also a fixed version.
References
Configurations
No configuration.
History
21 Nov 2024, 09:23
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/activeadmin/activeadmin/releases/tag/v3.2.2 - | |
| References | () https://github.com/activeadmin/activeadmin/security/advisories/GHSA-9mg6-x45v-hcfm - | |
| References | () https://rubygems.org/gems/activeadmin/versions/3.2.2 - |
27 Oct 2024, 14:35
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-79 | |
| Summary | (es) El framework Active Admin (también conocido como activeadmin) anterior a 3.2.2 para Ruby on Rails permite XSS almacenado en ciertas situaciones en las que los usuarios pueden crear entidades (para editarlas luego en formularios) con nombres arbitrarios, también conocido como un problema de "leyendas de formularios dinámicos". 4.0.0.beta7 también es una versión correctora. | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.1 |
03 Jun 2024, 14:46
| Type | Values Removed | Values Added |
|---|---|---|
| Summary |
|
03 Jun 2024, 06:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-06-03 06:15
Updated : 2024-11-21 09:23
NVD link : CVE-2024-37031
Mitre link : CVE-2024-37031
CVE.ORG link : CVE-2024-37031
JSON object : View
Products Affected
No product.
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')