Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1yOHh4LTh2bTgteDZ3as4AA34N

Resque vulnerable to Reflected Cross Site Scripting through pathnames

Impact

resque-web in resque versions before 2.1.0 is vulnerable to reflected XSS through the current_queue parameter in the path of the queues endpoint.

Patches

v2.1.0

Workarounds

No known workarounds at this time. It is recommended to not click on 3rd party or untrusted links to the resque-web interface until you have patched your application.

References

https://github.com/resque/resque/issues/1679
https://github.com/resque/resque/pull/1687

Permalink: https://github.com/advisories/GHSA-r8xx-8vm8-x6wj
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1yOHh4LTh2bTgteDZ3as4AA34N
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: 5 months ago
Updated: 3 months ago

CVSS Score: 6.3
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N

Identifiers: GHSA-r8xx-8vm8-x6wj, CVE-2023-50724
References:

• https://github.com/resque/resque/security/advisories/GHSA-r8xx-8vm8-x6wj
• https://github.com/resque/resque/issues/1679
• https://github.com/resque/resque/pull/1687
• https://github.com/resque/resque/commit/e8e2367fff6990d13109ec2483a456a05fbf9811
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/resque/CVE-2023-50724.yml
• https://nvd.nist.gov/vuln/detail/CVE-2023-50724
• https://github.com/advisories/GHSA-r8xx-8vm8-x6wj

Repository: https://github.com/resque/resque
Blast Radius: 24.6

Affected Packages