{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2024-37031", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2025-02-13T15:59:48.084Z", "datePublished": "2024-06-03T05:54:46.881Z", "dateReserved": "2024-05-31T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-06-03T05:54:47.177Z"}, "descriptions": [{"lang": "en", "value": "The Active Admin (aka activeadmin) framework before 3.2.2 for Ruby on Rails allows stored XSS in certain situations where users can create entities (to be later edited in forms) with arbitrary names, aka a \"dynamic form legends\" issue. 4.0.0.beta7 is also a fixed version."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://rubygems.org/gems/activeadmin/versions/3.2.2"}, {"url": "https://github.com/activeadmin/activeadmin/releases/tag/v3.2.2"}, {"url": "https://github.com/activeadmin/activeadmin/security/advisories/GHSA-9mg6-x45v-hcfm"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-79", "lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-07-29T14:31:24.266672Z", "id": "CVE-2024-37031", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-27T13:27:32.146Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:43:50.986Z"}, "title": "CVE Program Container", "references": [{"url": "https://rubygems.org/gems/activeadmin/versions/3.2.2", "tags": ["x_transferred"]}, {"url": "https://github.com/activeadmin/activeadmin/releases/tag/v3.2.2", "tags": ["x_transferred"]}, {"url": "https://github.com/activeadmin/activeadmin/security/advisories/GHSA-9mg6-x45v-hcfm", "tags": ["x_transferred"]}]}]}, "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://rubygems.org/gems/activeadmin/versions/3.2.2", "tags": ["x_transferred"]}, {"url": "https://github.com/activeadmin/activeadmin/releases/tag/v3.2.2", "tags": ["x_transferred"]}, {"url": "https://github.com/activeadmin/activeadmin/security/advisories/GHSA-9mg6-x45v-hcfm", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:43:50.986Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-37031", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-07-29T14:31:24.266672Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-29T14:31:28.046Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://rubygems.org/gems/activeadmin/versions/3.2.2"}, {"url": "https://github.com/activeadmin/activeadmin/releases/tag/v3.2.2"}, {"url": "https://github.com/activeadmin/activeadmin/security/advisories/GHSA-9mg6-x45v-hcfm"}], "descriptions": [{"lang": "en", "value": "The Active Admin (aka activeadmin) framework before 3.2.2 for Ruby on Rails allows stored XSS in certain situations where users can create entities (to be later edited in forms) with arbitrary names, aka a \"dynamic form legends\" issue. 4.0.0.beta7 is also a fixed version."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-06-03T05:54:47.177Z"}}}, "cveMetadata": {"cveId": "CVE-2024-37031", "state": "PUBLISHED", "dateUpdated": "2025-02-13T15:59:48.084Z", "dateReserved": "2024-05-31T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2024-06-03T05:54:46.881Z", "assignerShortName": "mitre"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Active Admin (aka activeadmin) framework before 3.2.2 for Ruby on Rails allows stored XSS in certain situations where users can create entities (to be later edited in forms) with arbitrary names, aka a \"dynamic form legends\" issue. 4.0.0.beta7 is also a fixed version."}, {"lang": "es", "value": "El framework Active Admin (tambi\u00e9n conocido como activeadmin) anterior a 3.2.2 para Ruby on Rails permite XSS almacenado en ciertas situaciones en las que los usuarios pueden crear entidades (para editarlas luego en formularios) con nombres arbitrarios, tambi\u00e9n conocido como un problema de \"leyendas de formularios din\u00e1micos\". 4.0.0.beta7 tambi\u00e9n es una versi\u00f3n correctora."}], "id": "CVE-2024-37031", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2024-06-03T06:15:10.143", "references": [{"source": "cve@mitre.org", "url": "https://github.com/activeadmin/activeadmin/releases/tag/v3.2.2"}, {"source": "cve@mitre.org", "url": "https://github.com/activeadmin/activeadmin/security/advisories/GHSA-9mg6-x45v-hcfm"}, {"source": "cve@mitre.org", "url": "https://rubygems.org/gems/activeadmin/versions/3.2.2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/activeadmin/activeadmin/releases/tag/v3.2.2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/activeadmin/activeadmin/security/advisories/GHSA-9mg6-x45v-hcfm"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://rubygems.org/gems/activeadmin/versions/3.2.2"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{}