CVE-2022-44303
Resque Scheduler Reflected XSS In Delayed Jobs View
Impact
### Impact Resque Scheduler version 1.27.4 and above are affected by a cross-site scripting vulnerability. A remote attacker can inject javascript code to the "{schedule_job}" or "args" parameter in /resque/delayed/jobs/{schedule_job}?args={args_id} to execute javascript at client side. ### Patches Fixed in v4.10.2 ### Workarounds No known workarounds at this time. It is recommended to not click on 3rd party or untrusted links to the resque-web interface until you have patched your application. ### References * https://nvd.nist.gov/vuln/detail/CVE-2022-44303 * https://github.com/resque/resque-scheduler/issues/761 * https://github.com/resque/resque/issues/1885 * https://github.com/resque/resque-scheduler/pull/780 * https://github.com/resque/resque-scheduler/pull/783
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| rubygems | resque-scheduler | >= 1.27.4, < 4.10.2 | 4.10.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Resque-Scheduler Project | Resque-Scheduler | All versions |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://trungvm.gitbook.io/cves/resque/resque-1.27.4-multiple-reflected-xss-in-resque-schedule-job
- https://github.com/advisories/GHSA-9hmq-fm33-x4xx
- https://github.com/resque/resque-scheduler/security/advisories/GHSA-9hmq-fm33-x4xx
- https://nvd.nist.gov/vuln/detail/CVE-2022-44303
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/resque-scheduler/CVE-2022-44303.yml