Improper Input Validation Affecting avo package, versions <2.33.3
Threat Intelligence
Exploit Maturity
Proof of concept
EPSS
0.24% (63rd
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RUBY-AVO-5666494
- published 6 Jun 2023
- disclosed 6 Jun 2023
- credit FLX-0x00
Introduced: 6 Jun 2023
CVE-2023-34102 Open this link in a new tabHow to fix?
Upgrade avo to version 2.33.3 or higher.
Overview
Affected versions of this package are vulnerable to Improper Input Validation via the "polymorphic field" implementation, due to the lack of validation of user input when updating or creating a new polymorphic resource. An attacker can exploit this vulnerability by manipulating the class names in the database entries.
Note: This is only exploitable if the necessary conditions, such as the ability to update or create polymorphic resources, are met.
References
CVSS Scores
version 3.1