GitHub Advisoryadvisory · RubyGems

GHSA-r9mq-m72x-257g Resque vulnerable to reflected XSS in Queue Endpoint

MEDIUM Published 2023-12-18 Modified 2023-12-22 Official page ↗
Aliases
CVE-2023-50727
Ecosystem
RubyGems
Packages
resque
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N
Weaknesses
CWE-233, CWE-79
Reviewed
2023-12-18

Affected packages

• RubyGems resque: < 2.6.0 → fixed in 2.6.0

Description

Impact Reflected XSS can be performed using the current_queue portion of the path on the /queues endpoint of resque-web. Patches v2.6.0 Workarounds No known workarounds at this time. It is recommended to not click on 3rd party or untrusted links to the resque-web interface until you have patched your application. References https://github.com/resque/resque/pull/1865

Related

Alias · CVE (1)

  • CVE-2023-50727 Resque is a Redis-backed Ruby library for creating background jobs, placing them on multiple queues, and processing them later. vulnerability

Weakness · CWE (2)

  • CWE-233 Improper Handling of Parameters weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References