Django REST framework

Lookup for vulnerabilities affecting packages.

Vulnerability_id VCID-43my-2hzv-5ban

Summary

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
Avo is an open source ruby on rails admin panel creation framework. The polymorphic field type stores the classes to operate on when updating a record with user input, and does not validate them in the back end. This can lead to unexpected behavior, remote code execution, or application crashes when viewing a manipulated record. This issue has been addressed in commit `ec117882d` which is expected to be included in subsequent releases. Users are advised to limit access to untrusted users until a new release is made.

Aliases

alias	CVE-2023-34102

alias	GHSA-86h2-2g4g-29qx

Fixed_packages

url	pkg:gem/avo@2.33.3
purl	pkg:gem/avo@2.33.3
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:gem/avo@2.33.3

Affected_packages

References

reference_url	https://github.com/avo-hq/avo/commit/ec117882ddb1b519481bdd046dc3cfa4474e6e17
reference_id
reference_type
scores
url	https://github.com/avo-hq/avo/commit/ec117882ddb1b519481bdd046dc3cfa4474e6e17

reference_url	https://nvd.nist.gov/vuln/detail/CVE-2023-34102
reference_id	CVE-2023-34102
reference_type
scores
url	https://nvd.nist.gov/vuln/detail/CVE-2023-34102

reference_url	https://github.com/avo-hq/avo/security/advisories/GHSA-86h2-2g4g-29qx
reference_id	GHSA-86h2-2g4g-29qx
reference_type
scores
url	https://github.com/avo-hq/avo/security/advisories/GHSA-86h2-2g4g-29qx

Weaknesses

cwe_id	1035
name	OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.

cwe_id	470
name	Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
description	The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.

cwe_id	937
name	OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.

Exploits

Severity_range_score null

Exploitability null

Weighted_severity null

Risk_score null

Resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-43my-2hzv-5ban

Vulnerability Instance