{"id":"CVE-2023-50727","published":"2023-12-22T20:10:10Z","modified":"2025-04-23T16:17:49Z","title":"Resque vulnerable to reflected XSS in Queue Endpoint","vendor":"resque","product":"resque","tier":"tail","description":{"text":"Resque is a Redis-backed Ruby library for creating background jobs, placing them on multiple queues, and processing them later. Reflected XSS issue occurs when /queues is appended with /\"><svg%20onload=alert(domain)>. This issue has been patched in version 2.6.0.","provenance":"source","from":"CVE.org"},"cvss":{"score":6.3,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00514,"percentile":0.43822,"provenance":"source"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"references":[{"url":"https://github.com/resque/resque/security/advisories/GHSA-r9mq-m72x-257g","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/resque/resque/pull/1865","tags":["x_refsource_MISC"]},{"url":"https://github.com/resque/resque/commit/7623b8dfbdd0a07eb04b19fb25b16a8d6f087f9a","tags":["x_refsource_MISC"]}],"priority":{"score":13.2,"factors":[{"name":"EPSS percentile","points":8.76},{"name":"CVSS severity","points":4.41}]},"vendorSlug":"resque","affectedVersions":[{"vendor":"resque","product":"resque","versions":["< 2.6.0"]}],"affected":[{"ecosystem":"RubyGems","package":"resque","vulnerableRanges":["<2.6.0"],"patched":["2.6.0"],"from":["GHSA-r9mq-m72x-257g"],"provenance":"source"}],"euvd":{"id":"EUVD-2023-3287","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-resque-cve-2023-50724","packageHistory":[{"cve":"CVE-2023-50724","published":"2023-12-21","fixed":"2.1.0","kev":false},{"cve":"CVE-2023-50725","published":"2023-12-22","fixed":"2.2.1","kev":false,"link":{"from":"CVE-2023-50725","to":"CVE-2023-50727","relation":"successor","confidence":"medium","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"RubyGems:resque","fromFixed":"2.2.1","toFixed":"2.6.0","daysApart":0},{"kind":"similar","provenance":"machine","score":0.72,"basis":"same product + CWE + description similarity"}]}},{"cve":"CVE-2023-50727","published":"2023-12-22","fixed":"2.6.0","kev":false}],"package":"RubyGems:resque"}}