Veracode Vulnerability DatabaseVERACODE:44746Cross Site Scripting (XSS)
6.1 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
5.9 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
35.8%
resque-scheduler is vulnerable to Reflected Cross Site Scripting (XSS). The vulnerability is due to lack of {schedule_job} or args parameter sanitizion while processing a /resque/delayed/jobs/{schedule_job}?args={args_id} request. An attacker can send a maliciously crafted url replacing {schedule_job} or the args parameter leading to Reflected Cross Site Scripting (XSS) when this url is rendered in the browser
| CPE | Name | Operator | Version |
|---|---|---|---|
| resque-scheduler | le | 4.10.1 | |
| resque-scheduler | le | 4.10.1 |
References
github.com/advisories/GHSA-9hmq-fm33-x4xx
github.com/resque/resque-scheduler/commit/f7b26fbb5a85762410541d8efdd63df353c3f25e
github.com/resque/resque-scheduler/issues/761
github.com/resque/resque-scheduler/pull/783
github.com/resque/resque/issues/1885
trungvm.gitbook.io/cves/resque/resque-1.27.4-multiple-reflected-xss-in-resque-schedule-job
Related
6.1 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
5.9 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
35.8%