GitHub Advisoryadvisory · RubyGems

GHSA-gc3j-vvwf-4rp8 Resque vulnerable to reflected XSS in resque-web failed and queues lists

MEDIUM Published 2023-12-18 Modified 2023-12-22 Official page ↗
Aliases
CVE-2023-50725
Ecosystem
RubyGems
Packages
resque
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N
Weaknesses
CWE-233, CWE-79
Reviewed
2023-12-18

Affected packages

• RubyGems resque: < 2.2.1 → fixed in 2.2.1

Description

Impact The following paths in resque-web have been found to be vulnerable to reflected XSS: ``` /failed/?class=alert(document.cookie) /queues/> ``` Patches v2.2.1 Workarounds No known workarounds at this time. It is recommended to not click on 3rd party or untrusted links to the resque-web interface until you have patched your application. References https://github.com/resque/resque/pull/1790

Related

Alias · CVE (1)

  • CVE-2023-50725 Resque is a Redis-backed Ruby library for creating background jobs, placing them on multiple queues, and processing them later. vulnerability

Weakness · CWE (2)

  • CWE-233 Improper Handling of Parameters weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References