GHSA-9hmq-fm33-x4xx: Resque Scheduler Reflected XSS In Delayed Jobs View

Skip to content

Sign in

CVE-2022-44303

• • Actions

    Automate any workflow

  • Packages

    Host and manage packages

  • Security

    Find and fix vulnerabilities

  • Codespaces

    Instant dev environments

  • Copilot

    Write better code with AI

  • Code review

    Manage code changes

  • Issues

    Plan and track work

  • Discussions

    Collaborate outside of code

Explore

*   All features
*   Documentation
*   GitHub Skills
*   Blog

• For

  • Enterprise
  • Teams
  • Startups
  • Education

  By Solution

  • CI/CD & Automation
  • DevOps
  • DevSecOps

  Resources

  • Learning Pathways
  • White papers, Ebooks, Webinars
  • Customer Stories
  • Partners

• • GitHub Sponsors

    Fund open source developers

*   The ReadME Project
    
    GitHub community articles
    

Repositories

*   Topics
*   Trending
*   Collections

• Pricing

Search code, repositories, users, issues, pull requests…

Provide feedback

We read every piece of feedback, and take your input very seriously.

Include my email address so I can be contacted

Saved searches****Use saved searches to filter your results more quickly

Sign in

Sign up

1. GitHub Advisory Database
2. GitHub Reviewed
3. CVE-2022-44303

Resque Scheduler Reflected XSS In Delayed Jobs View

Moderate severity GitHub Reviewed Published Dec 18, 2023 in resque/resque-scheduler

Vulnerability details Dependabot alerts 0

Package

bundler resque-scheduler (RubyGems)

Affected versions

>= 1.27.4, < 4.10.2

Patched versions

4.10.2

Description

Impact

Resque Scheduler version 1.27.4 and above are affected by a cross-site scripting vulnerability. A remote attacker can inject javascript code to the “{schedule_job}” or “args” parameter in /resque/delayed/jobs/{schedule_job}?args={args_id} to execute javascript at client side.

Patches

Fixed in v4.10.2

Workarounds

No known workarounds at this time. It is recommended to not click on 3rd party or untrusted links to the resque-web interface until you have patched your application.

References

• https://nvd.nist.gov/vuln/detail/CVE-2022-44303
• resque/resque-scheduler#761
• resque/resque#1885
• resque/resque-scheduler#780
• resque/resque-scheduler#783

References

• GHSA-9hmq-fm33-x4xx
• https://nvd.nist.gov/vuln/detail/CVE-2022-44303
• https://trungvm.gitbook.io/cves/resque/resque-1.27.4-multiple-reflected-xss-in-resque-schedule-job

PatrickTulskie published to resque/resque-scheduler

Dec 18, 2023

Published to the GitHub Advisory Database

Dec 18, 2023

Reviewed

Dec 18, 2023

Severity

Moderate

6.3

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

Low

User interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

None

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N

Weaknesses

CWE-79

CVE ID

CVE-2022-44303

GHSA ID

GHSA-9hmq-fm33-x4xx

Source code

resque/resque-scheduler

Credits

• PatrickTulskie Remediation developer

Checking history

See something to contribute? Suggest improvements for this vulnerability.