Skip to content
Fencer Vulns
high 8.3

CVE-2023-34102 json

Possible unsafe reflection / partial denial of service in avo

published 2023-06-05 3 y ago modified 2026-09-10 1 mo ago also GHSA-86h2-2g4g-29qx , EUVD-2023-1744

cvss
8.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.6%
EPSS 1.6% chance of exploitation in 30 days, percentile 76%
public exploits
0
none known

Summary

Avo is an open source ruby on rails admin panel creation framework. The polymorphic field type stores the classes to operate on when updating a record with user input, and does not validate them in the back end. This can lead to unexpected behavior, remote code execution, or application crashes when viewing a manipulated record. This issue has been addressed in commit `ec117882d` which is expected to be included in subsequent releases. Users are advised to limit access to untrusted users until a new release is made.

Patch / fix

  • rubygems avo 2.33.3

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
total
Assessed
22 mo ago

Exploit prediction

1.61% chance of exploitation in the next 30 days, higher than 76% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/avo-hq/avo/security/advisories/GHSA-86h2-2g4g-29qx referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 8.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
NVD 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
GitHub 3.1 8.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H

Affected packages

ecosystem package affected fixed in
rubygems avo
<2.33.3
>=3.0.0.pre1, <=3.0.0.pre12
2.33.3

Affected products

  • avo-hq avo

Classification

Weakness
  • CWE-20 Improper Input Validation
  • CWE-470 Use of Externally-Controlled Input to Select Classes or Code

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.