GitHub Advisoryadvisory · RubyGems

GHSA-r8xx-8vm8-x6wj Resque vulnerable to Reflected Cross Site Scripting through pathnames

MEDIUM Published 2023-12-18 Modified 2024-01-19 Official page ↗
Aliases
CVE-2023-50724
Ecosystem
RubyGems
Packages
resque
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N
Weaknesses
CWE-233, CWE-79
Reviewed
2023-12-18

Affected packages

• RubyGems resque: < 2.1.0 → fixed in 2.1.0

Description

Impact resque-web in resque versions before 2.1.0 is vulnerable to reflected XSS through the current_queue parameter in the path of the queues endpoint. Patches v2.1.0 Workarounds No known workarounds at this time. It is recommended to not click on 3rd party or untrusted links to the resque-web interface until you have patched your application. References https://github.com/resque/resque/issues/1679 https://github.com/resque/resque/pull/1687

Related

Alias · CVE (1)

  • CVE-2023-50724 Resque (pronounced like "rescue") is a Redis-backed library for creating background jobs, placing those jobs on multiple queues, and… vulnerability

Weakness · CWE (2)

  • CWE-233 Improper Handling of Parameters weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References