« Volver al listado

CVE-2024-37031

Estado: AplazadaMedia (6.1)—

The Active Admin (aka activeadmin) framework before 3.2.2 for Ruby on Rails allows stored XSS in certain situations where users can create entities (to be later edited in forms) with arbitrary names, aka a "dynamic form legends" issue. 4.0.0.beta7 is also a fixed version.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Activeadmin — ActiveadminAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-37031",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-37031",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-07-29T14:31:24.266672Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2024-06-03T06:15:10.143",
  "references": [
    {
      "url": "https://github.com/activeadmin/activeadmin/releases/tag/v3.2.2",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/activeadmin/activeadmin/security/advisories/GHSA-9mg6-x45v-hcfm",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://rubygems.org/gems/activeadmin/versions/3.2.2",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/activeadmin/activeadmin/releases/tag/v3.2.2",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/activeadmin/activeadmin/security/advisories/GHSA-9mg6-x45v-hcfm",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://rubygems.org/gems/activeadmin/versions/3.2.2",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Active Admin (aka activeadmin) framework before 3.2.2 for Ruby on Rails allows stored XSS in certain situations where users can create entities (to be later edited in forms) with arbitrary names, aka a \"dynamic form legends\" issue. 4.0.0.beta7 is also a fixed version."
    },
    {
      "lang": "es",
      "value": "El framework Active Admin (también conocido como activeadmin) anterior a 3.2.2 para Ruby on Rails permite XSS almacenado en ciertas situaciones en las que los usuarios pueden crear entidades (para editarlas luego en formularios) con nombres arbitrarios, también conocido como un problema de \"leyendas de formularios dinámicos\". 4.0.0.beta7 también es una versión correctora."
    }
  ],
  "lastModified": "2026-06-17T07:37:38.273",
  "sourceIdentifier": "cve@mitre.org"
}