{"id":"CVE-2023-50724","published":"2023-12-21T14:50:29Z","modified":"2024-08-27T15:02:43Z","title":"Resque vulnerable to reflected cross site scripting through pathname","vendor":"resque","product":"resque","tier":"tail","description":{"text":"Resque (pronounced like \"rescue\") is a Redis-backed library for creating background jobs, placing those jobs on multiple queues, and processing them later. resque-web in resque versions before 2.1.0 are vulnerable to reflected XSS through the current_queue parameter in the path of the queues endpoint. This issue has been patched in version 2.1.0.\n","provenance":"source","from":"CVE.org"},"cvss":{"score":6.3,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00484,"percentile":0.41716,"provenance":"source"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"references":[{"url":"https://github.com/resque/resque/security/advisories/GHSA-r8xx-8vm8-x6wj","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/resque/resque/issues/1679","tags":["x_refsource_MISC"]},{"url":"https://github.com/resque/resque/pull/1687","tags":["x_refsource_MISC"]}],"priority":{"score":12.8,"factors":[{"name":"EPSS percentile","points":8.34},{"name":"CVSS severity","points":4.41}]},"vendorSlug":"resque","affectedVersions":[{"vendor":"resque","product":"resque","versions":["< 2.1.0"]}],"affected":[{"ecosystem":"RubyGems","package":"resque","vulnerableRanges":["<2.1.0"],"patched":["2.1.0"],"from":["GHSA-r8xx-8vm8-x6wj"],"provenance":"source"}],"euvd":{"id":"EUVD-2023-3286","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-resque-cve-2023-50724","children":[{"from":"CVE-2023-50724","to":"CVE-2023-50725","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"RubyGems:resque","fromFixed":"2.1.0","toFixed":"2.2.1","daysApart":1},{"kind":"same-code","provenance":"machine","files":["lib/resque/server/views/queues.erb"],"commits":["https://github.com/resque/resque/commit/e8e2367fff6990d13109ec2483a456a05fbf9811","https://github.com/resque/resque/commit/ee99d2ed6cc75d9d384483b70c2d96d312115f07"],"basis":"rarely changed file"},{"kind":"similar","provenance":"machine","score":0.66,"basis":"same product + CWE + description similarity"}]},{"from":"CVE-2023-50724","to":"CVE-2023-50727","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["lib/resque/server/views/queues.erb"],"commits":["https://github.com/resque/resque/commit/e8e2367fff6990d13109ec2483a456a05fbf9811","https://github.com/resque/resque/commit/7623b8dfbdd0a07eb04b19fb25b16a8d6f087f9a"],"basis":"rarely changed file"},{"kind":"similar","provenance":"machine","score":0.66,"basis":"same product + CWE + description similarity"}]}],"packageHistory":[{"cve":"CVE-2023-50724","published":"2023-12-21","fixed":"2.1.0","kev":false},{"cve":"CVE-2023-50725","published":"2023-12-22","fixed":"2.2.1","kev":false},{"cve":"CVE-2023-50727","published":"2023-12-22","fixed":"2.6.0","kev":false}],"package":"RubyGems:resque"}}