What is GHSA-h3r8-h5qw-4r35?

GHSA-h3r8-h5qw-4r35 is a security advisory published by GitHub Security Advisories with High severity. sidekiq vulnerable to cross-site scripting

Which CVE IDs does GHSA-h3r8-h5qw-4r35 cover?

GHSA-h3r8-h5qw-4r35 covers the following CVE IDs: CVE-2023-1892. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-h3r8-h5qw-4r35?

GHSA-h3r8-h5qw-4r35 has a CVSS v3 base score of 8.3, published by GitHub Security Advisories.

Which products are affected by GHSA-h3r8-h5qw-4r35?

GHSA-h3r8-h5qw-4r35 affects 1 product, including: rubygems/sidekiq:\u003e= 7.0.4, \u003c 7.0.8.

GHSA-h3r8-h5qw-4r35HighCVSS 8.3

sidekiq vulnerable to cross-site scripting

Vendor

GitHub Security Advisories

Published

April 21, 2023

Last Modified

May 1, 2024

🔗 CVE IDs covered (1)

CVE-2023-1892 →

📋 Description

sidekiq from 7.0.4 to 7.0.7 is vulnerable to reflected cross-site scripting. A fix was released in version 7.0.8.

🎯 Affected products1

rubygems/sidekiq:>= 7.0.4, < 7.0.8

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2023-1892
https://github.com/sidekiq/sidekiq/commit/458fdf74176a9881478c48dc5cf0269107b22214
https://huntr.dev/bounties/e35e5653-c429-4fb8-94a3-cbc123ae4777
https://github.com/sidekiq/sidekiq/blob/main/Changes.md#708
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/sidekiq/CVE-2023-1892.yml
https://github.com/advisories/GHSA-h3r8-h5qw-4r35