medium6.1
CVE-2021-30151
Cross-site Scripting in Sidekiq
Impact
Sidekiq through 5.1.3 and 6.x through 6.2.0 allows XSS via the queue name of the live-poll feature when Internet Explorer is used.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| rubygems | sidekiq | < 5.2.0 | 5.2.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Contribsys | Sidekiq | through 5.1.3 from 6.0.0 through 6.2.0 |
| Debian | Debian Linux | Version 9.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/mperham/sidekiq/issues/4852
- https://lists.debian.org/debian-lts-announce/2022/03/msg00015.html
- https://lists.debian.org/debian-lts-announce/2023/03/msg00011.html
- https://github.com/advisories/GHSA-grh7-935j-hg6w
- https://nvd.nist.gov/vuln/detail/CVE-2021-30151
- https://github.com/mperham/sidekiq/commit/64f70339d1dcf50a55c00d36bfdb61d97ec63ed8