Mys7Ic

**Name of the Vulnerable Software and Affected Versions** Avo versions 2.46.0 through 3.2.3 **Description** A stored cross-site scripting (XSS) vulnerability was found in the `key value` field of Avo. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the victim's browser. The value of the `key value` is inserted directly into the HTML code and is not properly sanitized before it is inserted into the HTML code. This vulnerability could be used to steal sensitive information from victims that could be used to hijack victims' accounts or redirect them to malicious websites. **Recommendations** For Avo versions 2.46.0 through 3.2.3, upgrade to version 3.2.4 or 2.47.0 to resolve the issue. As a temporary workaround, consider disabling the `key value` field until a patch is available. Restrict access to the `key value` field to minimize the risk of exploitation. Avoid using the `key value` field in the affected Avo versions until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Avo (affected versions not specified) **Description** The issue concerns some Avo fields being vulnerable to Cross Site Scripting (XSS) when rendering HTML-based content. Attackers need form edit privilege to exploit this vulnerability, but the results are stored, and no specific timing is required. This can be exploited by an attacker to store JavaScript code in any trix field by intercepting the request and modifying the post data. The impact of this vulnerability is that attackers may be able to gain access to accounts that require special protection, such as administrators of the web service. **Recommendations** To resolve the issue, users are advised to configure CSP headers for their application and to limit untrusted user access as a mitigation. Additionally, the content of a field that contains HTML code should be sanitized using the according Rails helper, which uses a whitelist of known-safe tags and attributes. This security consideration should also be applied to the `as html` attribute because it may contain user-controlled input. As a temporary workaround, consider disabling the trix field until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.