CVE-2023-50724 - Vulnerability Details - OpenCVE

Resque (pronounced like "rescue") is a Redis-backed library for creating background jobs, placing those jobs on multiple queues, and processing them later. resque-web in resque versions before 2.1.0 are vulnerable to reflected XSS through the current_queue parameter in the path of the queues endpoint. This issue has been patched in version 2.1.0.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact High

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00943.

Key SSVC decision points have not yet been added.

Vendors	Products
Resque	Resque

Configuration 1 [-]

cpe:2.3:a:resque:resque:*:*:*:*:*:ruby:*:*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2023-3286	Resque (pronounced like "rescue") is a Redis-backed library for creating background jobs, placing those jobs on multiple queues, and processing them later. resque-web in resque versions before 2.1.0 are vulnerable to reflected XSS through the current_queue parameter in the path of the queues endpoint. This issue has been patched in version 2.1.0.
Github GHSA	GHSA-r8xx-8vm8-x6wj	Resque vulnerable to Reflected Cross Site Scripting through pathnames

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://github.com/resque/resque/issues/1679
https://github.com/resque/resque/pull/1687
https://github.com/resque/resque/security/advisories/GHSA-r8xx-8vm8-x6wj

History

No history.

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2023-12-21T14:50:29.294Z

Updated: 2024-08-27T15:02:43.928Z

Reserved: 2023-12-11T17:53:36.031Z

Link: CVE-2023-50724

Vulnrichment

Updated: 2024-08-02T22:16:47.310Z

NVD

Status : Modified

Published: 2023-12-21T15:15:10.573

Modified: 2024-11-21T08:37:12.957

Link: CVE-2023-50724

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-50724", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2023-12-11T17:53:36.031Z", "datePublished": "2023-12-21T14:50:29.294Z", "dateUpdated": "2024-08-27T15:02:43.928Z"}, "containers": {"cna": {"title": "Resque vulnerable to reflected cross site scripting through pathname ", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/resque/resque/security/advisories/GHSA-r8xx-8vm8-x6wj", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/resque/resque/security/advisories/GHSA-r8xx-8vm8-x6wj"}, {"name": "https://github.com/resque/resque/issues/1679", "tags": ["x_refsource_MISC"], "url": "https://github.com/resque/resque/issues/1679"}, {"name": "https://github.com/resque/resque/pull/1687", "tags": ["x_refsource_MISC"], "url": "https://github.com/resque/resque/pull/1687"}], "affected": [{"vendor": "resque", "product": "resque", "versions": [{"version": "< 2.1.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-12-21T14:50:29.294Z"}, "descriptions": [{"lang": "en", "value": "Resque (pronounced like \"rescue\") is a Redis-backed library for creating background jobs, placing those jobs on multiple queues, and processing them later. resque-web in resque versions before 2.1.0 are vulnerable to reflected XSS through the current_queue parameter in the path of the queues endpoint. This issue has been patched in version 2.1.0.\n"}], "source": {"advisory": "GHSA-r8xx-8vm8-x6wj", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T22:16:47.310Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/resque/resque/security/advisories/GHSA-r8xx-8vm8-x6wj", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/resque/resque/security/advisories/GHSA-r8xx-8vm8-x6wj"}, {"name": "https://github.com/resque/resque/issues/1679", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/resque/resque/issues/1679"}, {"name": "https://github.com/resque/resque/pull/1687", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/resque/resque/pull/1687"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-08-27T14:51:32.748402Z", "id": "CVE-2023-50724", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-27T15:02:43.928Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/resque/resque/security/advisories/GHSA-r8xx-8vm8-x6wj", "name": "https://github.com/resque/resque/security/advisories/GHSA-r8xx-8vm8-x6wj", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "https://github.com/resque/resque/issues/1679", "name": "https://github.com/resque/resque/issues/1679", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://github.com/resque/resque/pull/1687", "name": "https://github.com/resque/resque/pull/1687", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T22:16:47.310Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-50724", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-08-27T14:51:32.748402Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-27T15:02:39.054Z"}}], "cna": {"title": "Resque vulnerable to reflected cross site scripting through pathname ", "source": {"advisory": "GHSA-r8xx-8vm8-x6wj", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "resque", "product": "resque", "versions": [{"status": "affected", "version": "< 2.1.0"}]}], "references": [{"url": "https://github.com/resque/resque/security/advisories/GHSA-r8xx-8vm8-x6wj", "name": "https://github.com/resque/resque/security/advisories/GHSA-r8xx-8vm8-x6wj", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/resque/resque/issues/1679", "name": "https://github.com/resque/resque/issues/1679", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/resque/resque/pull/1687", "name": "https://github.com/resque/resque/pull/1687", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Resque (pronounced like \"rescue\") is a Redis-backed library for creating background jobs, placing those jobs on multiple queues, and processing them later. resque-web in resque versions before 2.1.0 are vulnerable to reflected XSS through the current_queue parameter in the path of the queues endpoint. This issue has been patched in version 2.1.0.\n"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-12-21T14:50:29.294Z"}}}, "cveMetadata": {"cveId": "CVE-2023-50724", "state": "PUBLISHED", "dateUpdated": "2024-08-27T15:02:43.928Z", "dateReserved": "2023-12-11T17:53:36.031Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2023-12-21T14:50:29.294Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:resque:resque:*:*:*:*:*:ruby:*:*", "matchCriteriaId": "3748B26E-DE1D-4B6B-8A6E-C79BC6DBD0BF", "versionEndExcluding": "2.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Resque (pronounced like \"rescue\") is a Redis-backed library for creating background jobs, placing those jobs on multiple queues, and processing them later. resque-web in resque versions before 2.1.0 are vulnerable to reflected XSS through the current_queue parameter in the path of the queues endpoint. This issue has been patched in version 2.1.0.\n"}, {"lang": "es", "value": "Resque (pronunciado como \"rescue\") es una librer\u00eda respaldada por Redis para crear trabajos en segundo plano, colocar esos trabajos en varias colas y procesarlos m\u00e1s tarde. resque-web en versiones de resque anteriores a 2.1.0 es vulnerable al XSS reflejado a trav\u00e9s del par\u00e1metro current_queue en la ruta de las colas del endpoint. Este problema se solucion\u00f3 en la versi\u00f3n 2.1.0."}], "id": "CVE-2023-50724", "lastModified": "2024-11-21T08:37:12.957", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-12-21T15:15:10.573", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Issue Tracking", "Mitigation", "Third Party Advisory"], "url": "https://github.com/resque/resque/issues/1679"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/resque/resque/pull/1687"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/resque/resque/security/advisories/GHSA-r8xx-8vm8-x6wj"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Issue Tracking", "Mitigation", "Third Party Advisory"], "url": "https://github.com/resque/resque/issues/1679"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/resque/resque/pull/1687"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://github.com/resque/resque/security/advisories/GHSA-r8xx-8vm8-x6wj"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}