PT-2023-31623 · Resque · Resque
G-Rath
·
Publicado
2023-12-18
·
Atualizado
2024-01-02
·
CVE-2023-50724
CVSS v3.1
6.3
Média
| Vetor | AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
Resque versions prior to 2.1.0
Description
The issue is related to reflected Cross Site Scripting (XSS) through the
current queue parameter in the path of the queues endpoint. This allows for potential exploitation by manipulating the endpoint path. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited. The technical details about exploitation include the use of the current queue parameter in the queues endpoint.Recommendations
For Resque versions prior to 2.1.0, update to version 2.1.0 to resolve the issue.
As a temporary workaround, consider avoiding clicks on 3rd party or untrusted links to the resque-web interface until the application is patched.
Exploit
Correção
XSS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Resque