Описание
Resque (pronounced like "rescue") is a Redis-backed library for creating background jobs, placing those jobs on multiple queues, and processing them later. resque-web in resque versions before 2.1.0 are vulnerable to reflected XSS through the current_queue parameter in the path of the queues endpoint. This issue has been patched in version 2.1.0.
Ссылки
- ExploitIssue TrackingMitigationThird Party Advisory
- Patch
- Vendor Advisory
- ExploitIssue TrackingMitigationThird Party Advisory
- Patch
- Vendor Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 2.1.0 (исключая)
cpe:2.3:a:resque:resque:*:*:*:*:*:ruby:*:*
EPSS
Процентиль: 76%
0.00943
Низкий
6.3 Medium
CVSS3
6.1 Medium
CVSS3
Дефекты
CWE-79
Связанные уязвимости
CVSS3: 6.3
github
около 2 лет назад
Resque vulnerable to Reflected Cross Site Scripting through pathnames
EPSS
Процентиль: 76%
0.00943
Низкий
6.3 Medium
CVSS3
6.1 Medium
CVSS3
Дефекты
CWE-79