Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1yOW1xLW03MngtMjU3Z84AA34L

Resque vulnerable to reflected XSS in Queue Endpoint

Impact

Reflected XSS can be performed using the current_queue portion of the path on the /queues endpoint of resque-web.

Patches

v2.6.0

Workarounds

No known workarounds at this time. It is recommended to not click on 3rd party or untrusted links to the resque-web interface until you have patched your application.

References

https://github.com/resque/resque/pull/1865

Permalink: https://github.com/advisories/GHSA-r9mq-m72x-257g
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1yOW1xLW03MngtMjU3Z84AA34L
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: 5 months ago
Updated: 4 months ago

CVSS Score: 6.3
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N

Identifiers: GHSA-r9mq-m72x-257g, CVE-2023-50727
References:

• https://github.com/resque/resque/security/advisories/GHSA-r9mq-m72x-257g
• https://github.com/resque/resque/pull/1865
• https://github.com/resque/resque/commit/7623b8dfbdd0a07eb04b19fb25b16a8d6f087f9a
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/resque/CVE-2023-50727.yml
• https://nvd.nist.gov/vuln/detail/CVE-2023-50727
• https://github.com/advisories/GHSA-r9mq-m72x-257g

Repository: https://github.com/resque/resque
Blast Radius: 24.6

Affected Packages