What is GHSA-r9mq-m72x-257g?

GHSA-r9mq-m72x-257g is a security advisory published by GitHub Security Advisories with Medium severity. Resque vulnerable to reflected XSS in Queue Endpoint

Which CVE IDs does GHSA-r9mq-m72x-257g cover?

GHSA-r9mq-m72x-257g covers the following CVE IDs: CVE-2023-50727. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-r9mq-m72x-257g?

GHSA-r9mq-m72x-257g has a CVSS v3 base score of 6.3, published by GitHub Security Advisories.

Which products are affected by GHSA-r9mq-m72x-257g?

GHSA-r9mq-m72x-257g affects 1 product, including: rubygems/resque:\u003c 2.6.0.

GHSA-r9mq-m72x-257gMediumCVSS 6.3

Resque vulnerable to reflected XSS in Queue Endpoint

Vendor

GitHub Security Advisories

Published

December 18, 2023

Last Modified

December 22, 2023

🔗 CVE IDs covered (1)

CVE-2023-50727 →

📋 Description

Impact

Reflected XSS can be performed using the current_queue portion of the path on the /queues endpoint of resque-web.

Patches

v2.6.0

Workarounds

No known workarounds at this time. It is recommended to not click on 3rd party or untrusted links to the resque-web interface until you have patched your application.

References

https://github.com/resque/resque/pull/1865

🎯 Affected products1

rubygems/resque:< 2.6.0

🔗 References (6)

https://github.com/resque/resque/security/advisories/GHSA-r9mq-m72x-257g
https://github.com/resque/resque/pull/1865
https://github.com/resque/resque/commit/7623b8dfbdd0a07eb04b19fb25b16a8d6f087f9a
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/resque/CVE-2023-50727.yml
https://nvd.nist.gov/vuln/detail/CVE-2023-50727
https://github.com/advisories/GHSA-r9mq-m72x-257g