CVE-2024-37031 - Vulnerability Details - OpenCVE

The Active Admin (aka activeadmin) framework before 3.2.2 for Ruby on Rails allows stored XSS in certain situations where users can create entities (to be later edited in forms) with arbitrary names, aka a "dynamic form legends" issue. 4.0.0.beta7 is also a fixed version.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

References

Link	Providers
https://github.com/activeadmin/activeadmin/releases/tag/v3.2.2
https://github.com/activeadmin/activeadmin/security/advisories/GHSA-9mg6-x45v-hcfm
https://rubygems.org/gems/activeadmin/versions/3.2.2

History

Sun, 13 Jul 2025 13:45:00 +0000

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.00169}`	epss `{'score': 0.00221}`

Sat, 12 Jul 2025 13:45:00 +0000

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.00182}`	epss `{'score': 0.00169}`

Fri, 11 Jul 2025 13:45:00 +0000

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.00115}`	epss `{'score': 0.00182}`

Sun, 27 Oct 2024 14:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-79
Metrics		cvssV3_1 `{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2024-06-03T05:54:46.881Z

Updated: 2025-02-13T15:59:48.084Z

Reserved: 2024-05-31T00:00:00.000Z

Link: CVE-2024-37031

Vulnrichment

Updated: 2024-08-02T03:43:50.986Z

NVD

Status : Deferred

Published: 2024-06-03T06:15:10.143

Modified: 2026-04-15T00:35:42.020

Link: CVE-2024-37031

Redhat

No data.

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2024-37031", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2025-02-13T15:59:48.084Z", "datePublished": "2024-06-03T05:54:46.881Z", "dateReserved": "2024-05-31T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-06-03T05:54:47.177Z"}, "descriptions": [{"lang": "en", "value": "The Active Admin (aka activeadmin) framework before 3.2.2 for Ruby on Rails allows stored XSS in certain situations where users can create entities (to be later edited in forms) with arbitrary names, aka a \"dynamic form legends\" issue. 4.0.0.beta7 is also a fixed version."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://rubygems.org/gems/activeadmin/versions/3.2.2"}, {"url": "https://github.com/activeadmin/activeadmin/releases/tag/v3.2.2"}, {"url": "https://github.com/activeadmin/activeadmin/security/advisories/GHSA-9mg6-x45v-hcfm"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-79", "lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-07-29T14:31:24.266672Z", "id": "CVE-2024-37031", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-27T13:27:32.146Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:43:50.986Z"}, "title": "CVE Program Container", "references": [{"url": "https://rubygems.org/gems/activeadmin/versions/3.2.2", "tags": ["x_transferred"]}, {"url": "https://github.com/activeadmin/activeadmin/releases/tag/v3.2.2", "tags": ["x_transferred"]}, {"url": "https://github.com/activeadmin/activeadmin/security/advisories/GHSA-9mg6-x45v-hcfm", "tags": ["x_transferred"]}]}]}, "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://rubygems.org/gems/activeadmin/versions/3.2.2", "tags": ["x_transferred"]}, {"url": "https://github.com/activeadmin/activeadmin/releases/tag/v3.2.2", "tags": ["x_transferred"]}, {"url": "https://github.com/activeadmin/activeadmin/security/advisories/GHSA-9mg6-x45v-hcfm", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:43:50.986Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-37031", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-07-29T14:31:24.266672Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-29T14:31:28.046Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://rubygems.org/gems/activeadmin/versions/3.2.2"}, {"url": "https://github.com/activeadmin/activeadmin/releases/tag/v3.2.2"}, {"url": "https://github.com/activeadmin/activeadmin/security/advisories/GHSA-9mg6-x45v-hcfm"}], "descriptions": [{"lang": "en", "value": "The Active Admin (aka activeadmin) framework before 3.2.2 for Ruby on Rails allows stored XSS in certain situations where users can create entities (to be later edited in forms) with arbitrary names, aka a \"dynamic form legends\" issue. 4.0.0.beta7 is also a fixed version."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-06-03T05:54:47.177Z"}}}, "cveMetadata": {"cveId": "CVE-2024-37031", "state": "PUBLISHED", "dateUpdated": "2025-02-13T15:59:48.084Z", "dateReserved": "2024-05-31T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2024-06-03T05:54:46.881Z", "assignerShortName": "mitre"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Active Admin (aka activeadmin) framework before 3.2.2 for Ruby on Rails allows stored XSS in certain situations where users can create entities (to be later edited in forms) with arbitrary names, aka a \"dynamic form legends\" issue. 4.0.0.beta7 is also a fixed version."}, {"lang": "es", "value": "El framework Active Admin (tambi\u00e9n conocido como activeadmin) anterior a 3.2.2 para Ruby on Rails permite XSS almacenado en ciertas situaciones en las que los usuarios pueden crear entidades (para editarlas luego en formularios) con nombres arbitrarios, tambi\u00e9n conocido como un problema de \"leyendas de formularios din\u00e1micos\". 4.0.0.beta7 tambi\u00e9n es una versi\u00f3n correctora."}], "id": "CVE-2024-37031", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2024-06-03T06:15:10.143", "references": [{"source": "cve@mitre.org", "url": "https://github.com/activeadmin/activeadmin/releases/tag/v3.2.2"}, {"source": "cve@mitre.org", "url": "https://github.com/activeadmin/activeadmin/security/advisories/GHSA-9mg6-x45v-hcfm"}, {"source": "cve@mitre.org", "url": "https://rubygems.org/gems/activeadmin/versions/3.2.2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/activeadmin/activeadmin/releases/tag/v3.2.2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/activeadmin/activeadmin/security/advisories/GHSA-9mg6-x45v-hcfm"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://rubygems.org/gems/activeadmin/versions/3.2.2"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}