{"id":"CVE-2023-50725","published":"2023-12-22T20:02:15Z","modified":"2024-08-02T22:16:47Z","title":"Resque vulnerable to reflected XSS in resque-web failed and queues lists","vendor":"resque","product":"resque","tier":"tail","description":{"text":"Resque is a Redis-backed Ruby library for creating background jobs, placing them on multiple queues, and processing them later. The following paths in resque-web have been found to be vulnerable to reflected XSS: \"/failed/?class=<script>alert(document.cookie)</script>\" and \"/queues/><img src=a onerror=alert(document.cookie)>\". This issue has been patched in version 2.2.1.","provenance":"source","from":"CVE.org"},"cvss":{"score":6.3,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00526,"percentile":0.44532,"provenance":"source"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"references":[{"url":"https://github.com/resque/resque/security/advisories/GHSA-gc3j-vvwf-4rp8","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/resque/resque/pull/1790","tags":["x_refsource_MISC"]},{"url":"https://github.com/resque/resque/commit/ee99d2ed6cc75d9d384483b70c2d96d312115f07","tags":["x_refsource_MISC"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/resque/CVE-2023-50725.yml","tags":["x_refsource_MISC"]}],"priority":{"score":13.3,"factors":[{"name":"EPSS percentile","points":8.91},{"name":"CVSS severity","points":4.41}]},"vendorSlug":"resque","affectedVersions":[{"vendor":"resque","product":"resque","versions":["< 2.2.1"]}],"affected":[{"ecosystem":"RubyGems","package":"resque","vulnerableRanges":["<2.2.1"],"patched":["2.2.1"],"from":["GHSA-gc3j-vvwf-4rp8"],"provenance":"source"}],"euvd":{"id":"EUVD-2023-3207","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-resque-cve-2023-50724","parents":[{"from":"CVE-2023-50724","to":"CVE-2023-50725","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"RubyGems:resque","fromFixed":"2.1.0","toFixed":"2.2.1","daysApart":1},{"kind":"same-code","provenance":"machine","files":["lib/resque/server/views/queues.erb"],"commits":["https://github.com/resque/resque/commit/e8e2367fff6990d13109ec2483a456a05fbf9811","https://github.com/resque/resque/commit/ee99d2ed6cc75d9d384483b70c2d96d312115f07"],"basis":"rarely changed file"},{"kind":"similar","provenance":"machine","score":0.66,"basis":"same product + CWE + description similarity"}]}],"children":[{"from":"CVE-2023-50725","to":"CVE-2023-50727","relation":"successor","confidence":"high","kind":"lineage","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"RubyGems:resque","fromFixed":"2.2.1","toFixed":"2.6.0","daysApart":0},{"kind":"same-code","provenance":"machine","files":["lib/resque/server/views/queues.erb"],"commits":["https://github.com/resque/resque/commit/ee99d2ed6cc75d9d384483b70c2d96d312115f07","https://github.com/resque/resque/commit/7623b8dfbdd0a07eb04b19fb25b16a8d6f087f9a"],"basis":"rarely changed file"},{"kind":"similar","provenance":"machine","score":0.72,"basis":"same product + CWE + description similarity"}]}],"packageHistory":[{"cve":"CVE-2023-50724","published":"2023-12-21","fixed":"2.1.0","kev":false},{"cve":"CVE-2023-50725","published":"2023-12-22","fixed":"2.2.1","kev":false},{"cve":"CVE-2023-50727","published":"2023-12-22","fixed":"2.6.0","kev":false}],"package":"RubyGems:resque"}}