CVEvulnerability
CVE-2022-23837
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2022-01-21
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:N/A:P
- Weaknesses
- CWE-770
Description
In api.rb in Sidekiq before 5.2.10 and 6.4.0, there is no limit on the number of days when requesting stats for the graph. This overloads the system, affecting the Web UI, and makes it unavailable to users.
Affected configurations
• contribsys sidekiq (< 5.2.10)
• contribsys sidekiq (>= 6.0.0 < 6.4.0)
• debian debian linux 9.0
Related
Weakness · CWE (1)
- CWE-770 Allocation of Resources Without Limits or Throttling weakness
References
- https://github.com/TUTUMSPACE/exploits/blob/main/sidekiq.md Exploit, Third Party Advisory
- https://github.com/mperham/sidekiq/commit/7785ac1399f1b28992adb56055f6acd88fd1d956 Patch, Third Party Advisory
- https://github.com/rubysec/ruby-advisory-db/pull/495 Patch, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/03/msg00015.html Mailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/03/msg00011.html lists.debian.org
- https://github.com/TUTUMSPACE/exploits/blob/main/sidekiq.md Exploit, Third Party Advisory
- https://github.com/mperham/sidekiq/commit/7785ac1399f1b28992adb56055f6acd88fd1d956 Patch, Third Party Advisory
- https://github.com/rubysec/ruby-advisory-db/pull/495 Patch, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/03/msg00015.html Mailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/03/msg00011.html lists.debian.org