CVE-2024-37031

{"id": "CVE-2024-37031", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2024-06-03T06:15:10.143", "references": [{"url": "https://github.com/activeadmin/activeadmin/releases/tag/v3.2.2", "source": "cve@mitre.org"}, {"url": "https://github.com/activeadmin/activeadmin/security/advisories/GHSA-9mg6-x45v-hcfm", "source": "cve@mitre.org"}, {"url": "https://rubygems.org/gems/activeadmin/versions/3.2.2", "source": "cve@mitre.org"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "The Active Admin (aka activeadmin) framework before 3.2.2 for Ruby on Rails allows stored XSS in certain situations where users can create entities (to be later edited in forms) with arbitrary names, aka a \"dynamic form legends\" issue. 4.0.0.beta7 is also a fixed version."}, {"lang": "es", "value": "El framework Active Admin (tambi\u00e9n conocido como activeadmin) anterior a 3.2.2 para Ruby on Rails permite XSS almacenado en ciertas situaciones en las que los usuarios pueden crear entidades (para editarlas luego en formularios) con nombres arbitrarios, tambi\u00e9n conocido como un problema de \"leyendas de formularios din\u00e1micos\". 4.0.0.beta7 tambi\u00e9n es una versi\u00f3n correctora."}], "lastModified": "2024-10-27T14:35:09.030", "sourceIdentifier": "cve@mitre.org"}