Cross Site Scripting Vulnerability in Contribsys Sidekiq Software
CVE-2023-46950

6.1MEDIUM

Key Information:

Vendor

Contribsys

Status
Sidekiq
Vendor
CVE Published:
1 March 2024

What is CVE-2023-46950?

A Cross Site Scripting (XSS) vulnerability has been identified in Contribsys Sidekiq, specifically version 6.5.8. This security flaw allows remote attackers to exploit crafted URLs targeting the filter functions, leading to unauthorized access to sensitive information. Organizations using this version of Sidekiq are at risk of exposing essential data to malicious actors, raising significant concerns regarding user privacy and application integrity. It is crucial for users to review their implementation and apply any relevant security updates or patches to mitigate potential threats.

References

https://github.com/mhenrixon/sidekiq-unique-jobs/security...
https://github.com/mhenrixon/sidekiq-unique-jobs/releases...
https://www.mgm-sp.com/cve/sidekiq-unique-jobs-reflected-...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.