Описание
Sidekiq-cron thru 2.3.1, an open-source scheduling add-on for Sidekiq, is vulnerable to a cross-site scripting (xss) vulnerability via crafted URL being rended from cron.erb.
A flaw was found in Sidekiq-cron, an open-source scheduling add-on for Sidekiq. A remote attacker could exploit this cross-site scripting (XSS) vulnerability by injecting malicious scripts into a crafted URL. When this URL is rendered from cron.erb, the attacker's script would execute in the victim's browser, potentially leading to information disclosure or session hijacking.
Меры по смягчению последствий
To mitigate this issue, restrict network access to the Sidekiq-cron web interface to trusted users and networks only. Implement firewall rules to limit access to the port on which Sidekiq-cron is exposed. Additionally, ensure that users accessing the interface are aware of phishing risks and avoid clicking untrusted links.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat 3scale API Management Platform 2 | 3scale-amp21/system | Fix deferred | ||
| Red Hat 3scale API Management Platform 2 | 3scale-amp22/system | Fix deferred | ||
| Red Hat 3scale API Management Platform 2 | 3scale-amp2/system-rhel7 | Fix deferred | ||
| Red Hat 3scale API Management Platform 2 | 3scale-amp2/system-rhel8 | Fix deferred | ||
| Red Hat 3scale API Management Platform 2 | 3scale-amp2/system-rhel9 | Fix deferred |
Показывать по
Дополнительная информация
Статус:
5.4 Medium
CVSS3
Связанные уязвимости
Sidekiq-cron thru 2.3.1, an open-source scheduling add-on for Sidekiq, is vulnerable to a cross-site scripting (xss) vulnerability via crafted URL being rended from cron.erb.
Sidekiq-cron is vulnerable to a cross-site scripting (xss) vulnerability via crafted URL
5.4 Medium
CVSS3