CVE-2024-32887 — Cross-site Scripting in Sidekiq

Vendor	Product	Version range	Fixed in
contribsys	sidekiq	>= 7.2.0 < 7.2.4	7.2.4
debian	ruby-sidekiq	—	—
sidekiq	sidekiq	—	—

Red Hat

ruby-sidekiq: Reflected XSS in Metrics Web Page

vendor_redhat·2024-04-26·CVSS 5.5

CVE-2024-32887 [MEDIUM] CWE-80 ruby-sidekiq: Reflected XSS in Metrics Web Page ruby-sidekiq: Reflected XSS in Metrics Web Page Sidekiq is simple, efficient background processing for Ruby. Sidekiq is reflected XSS vulnerability. The value of substr parameter is reflected in the response without any encoding, allowing an attacker to inject Javascript code into the response of the application. An attacker could exploit it to target users of the Sidekiq Web UI. Moreover, if other applications are deployed on the same domain or website as Sidekiq, users of those applications could also be affected, leading to a broader scope of compromise. Potentially compromising their accounts, forcing the users to perform sensitive actions, stealing sensitive data, performing CORS attacks, defacement of the web application, etc. This issue has been patched in version 7.2.4. A reflect

Debian

CVE-2024-32887: ruby-sidekiq - Sidekiq is simple, efficient background processing for Ruby. Sidekiq is reflecte...

vendor_debian·2024·CVSS 5.5

CVE-2024-32887 [MEDIUM] CVE-2024-32887: ruby-sidekiq - Sidekiq is simple, efficient background processing for Ruby. Sidekiq is reflecte... Sidekiq is simple, efficient background processing for Ruby. Sidekiq is reflected XSS vulnerability. The value of substr parameter is reflected in the response without any encoding, allowing an attacker to inject Javascript code into the response of the application. An attacker could exploit it to target users of the Sidekiq Web UI. Moreover, if other applications are deployed on the same domain or website as Sidekiq, users of those applications could also be affected, leading to a broader scope of compromise. Potentially compromising their accounts, forcing the users to perform sensitive actions, stealing sensitive data, performing CORS attacks, defacement of the web application, etc. This issue has been patched in version 7.2.4. Scope: local bookworm: resolved bullseye: resolved forky: r

GHSA

Sidekiq vulnerable to a Reflected XSS in Queues Web Page

ghsa·2024-04-26

CVE-2024-32887 [MEDIUM] CWE-79 Sidekiq vulnerable to a Reflected XSS in Queues Web Page Sidekiq vulnerable to a Reflected XSS in Queues Web Page ### Description: During the source Code Review of the metrics.erb view of the Sidekiq Web UI, A reflected XSS vulnerability is discovered. The value of substr parameter is reflected in the response without any encoding, allowing an attacker to inject Javascript code into the response of the application. This vulnerability can be exploited to target the users of the application, and users of other applications deployed on the same domain or website as that of the Sidekiq website. Successful exploit results may result in compromise of user accounts and user data. ### Impact: The impact of this vulnerability can be severe. An attacker could exploit it to target users of the Sidekiq Web UI. Moreover, if other applications are deployed

OSV

Sidekiq vulnerable to a Reflected XSS in Queues Web Page

osv·2024-04-26

CVE-2024-32887 [MEDIUM] Sidekiq vulnerable to a Reflected XSS in Queues Web Page Sidekiq vulnerable to a Reflected XSS in Queues Web Page ### Description: During the source Code Review of the metrics.erb view of the Sidekiq Web UI, A reflected XSS vulnerability is discovered. The value of substr parameter is reflected in the response without any encoding, allowing an attacker to inject Javascript code into the response of the application. This vulnerability can be exploited to target the users of the application, and users of other applications deployed on the same domain or website as that of the Sidekiq website. Successful exploit results may result in compromise of user accounts and user data. ### Impact: The impact of this vulnerability can be severe. An attacker could exploit it to target users of the Sidekiq Web UI. Moreover, if other applications are deployed

OSV

CVE-2024-32887: Sidekiq is simple, efficient background processing for Ruby

osv·2024-04-26·CVSS 5.5

CVE-2024-32887 [MEDIUM] CVE-2024-32887: Sidekiq is simple, efficient background processing for Ruby Sidekiq is simple, efficient background processing for Ruby. Sidekiq is reflected XSS vulnerability. The value of substr parameter is reflected in the response without any encoding, allowing an attacker to inject Javascript code into the response of the application. An attacker could exploit it to target users of the Sidekiq Web UI. Moreover, if other applications are deployed on the same domain or website as Sidekiq, users of those applications could also be affected, leading to a broader scope of compromise. Potentially compromising their accounts, forcing the users to perform sensitive actions, stealing sensitive data, performing CORS attacks, defacement of the web application, etc. This issue has been patched in version 7.2.4.

CVE-2024-32887: Sidekiq is simple, efficient background processing for Ruby. Sidekiq is reflected XSS vulnerability. The value of substr parameter is reflected in the response…

Affected

CVSS provenance