Denial of Service in Sidekiq Affecting Multiple Versions
CVE-2022-23837

7.5HIGH

Key Information:

Vendor

Contribsys

Status
Sidekiq
Vendor
CVE Published:
21 January 2022

What is CVE-2022-23837?

In Sidekiq versions prior to 5.2.10 and 6.4.0, a lack of limits on the number of days requested for stats can overwhelm the system. This flaw can lead to the Web UI becoming unresponsive, impeding user access and functionality. Organizations utilizing these versions should prioritize updates to mitigate potential disruptions.

References

https://github.com/mperham/sidekiq/commit/7785ac1399f1b28...
https://github.com/TUTUMSPACE/exploits/blob/main/sidekiq.md
https://github.com/rubysec/ruby-advisory-db/pull/495

EPSS Score

5% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.