CVE-2023-50727 - Vulnerability Details - OpenCVE

Resque is a Redis-backed Ruby library for creating background jobs, placing them on multiple queues, and processing them later. Reflected XSS issue occurs when /queues is appended with /"><svg%20onload=alert(domain)>. This issue has been patched in version 2.6.0.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact High

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Resque	Resque

Configuration 1 [-]

cpe:2.3:a:resque:resque:*:*:*:*:*:ruby:*:*

No data.

References

Link	Providers
https://github.com/resque/resque/commit/7623b8dfbdd0a07eb04b19fb25b16a8d6f087f9a
https://github.com/resque/resque/pull/1865
https://github.com/resque/resque/security/advisories/GHSA-r9mq-m72x-257g
https://nvd.nist.gov/vuln/detail/CVE-2023-50727
https://www.cve.org/CVERecord?id=CVE-2023-50727

History

Wed, 23 Apr 2025 17:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2023-12-22T20:10:10.964Z

Updated: 2025-04-23T16:17:49.438Z

Reserved: 2023-12-11T17:53:36.032Z

Link: CVE-2023-50727

Vulnrichment

Updated: 2024-08-02T22:16:47.210Z

NVD

Status : Modified

Published: 2023-12-22T21:15:07.690

Modified: 2024-11-21T08:37:13.413

Link: CVE-2023-50727

Redhat

Severity : Moderate

Publid Date: 2023-12-19T00:00:00Z

Links: CVE-2023-50727 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-50727", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2023-12-11T17:53:36.032Z", "datePublished": "2023-12-22T20:10:10.964Z", "dateUpdated": "2025-04-23T16:17:49.438Z"}, "containers": {"cna": {"title": "Resque vulnerable to reflected XSS in Queue Endpoint", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/resque/resque/security/advisories/GHSA-r9mq-m72x-257g", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/resque/resque/security/advisories/GHSA-r9mq-m72x-257g"}, {"name": "https://github.com/resque/resque/pull/1865", "tags": ["x_refsource_MISC"], "url": "https://github.com/resque/resque/pull/1865"}, {"name": "https://github.com/resque/resque/commit/7623b8dfbdd0a07eb04b19fb25b16a8d6f087f9a", "tags": ["x_refsource_MISC"], "url": "https://github.com/resque/resque/commit/7623b8dfbdd0a07eb04b19fb25b16a8d6f087f9a"}], "affected": [{"vendor": "resque", "product": "resque", "versions": [{"version": "< 2.6.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-12-22T20:10:10.964Z"}, "descriptions": [{"lang": "en", "value": "Resque is a Redis-backed Ruby library for creating background jobs, placing them on multiple queues, and processing them later. Reflected XSS issue occurs when /queues is appended with /\"><svg%20onload=alert(domain)>. This issue has been patched in version 2.6.0."}], "source": {"advisory": "GHSA-r9mq-m72x-257g", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T22:16:47.210Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/resque/resque/security/advisories/GHSA-r9mq-m72x-257g", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/resque/resque/security/advisories/GHSA-r9mq-m72x-257g"}, {"name": "https://github.com/resque/resque/pull/1865", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/resque/resque/pull/1865"}, {"name": "https://github.com/resque/resque/commit/7623b8dfbdd0a07eb04b19fb25b16a8d6f087f9a", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/resque/resque/commit/7623b8dfbdd0a07eb04b19fb25b16a8d6f087f9a"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-01-02T16:36:53.442840Z", "id": "CVE-2023-50727", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-23T16:17:49.438Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-50727", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2023-12-11T17:53:36.032Z", "datePublished": "2023-12-22T20:10:10.964Z", "dateUpdated": "2025-04-23T16:17:49.438Z"}, "containers": {"cna": {"title": "Resque vulnerable to reflected XSS in Queue Endpoint", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/resque/resque/security/advisories/GHSA-r9mq-m72x-257g", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/resque/resque/security/advisories/GHSA-r9mq-m72x-257g"}, {"name": "https://github.com/resque/resque/pull/1865", "tags": ["x_refsource_MISC"], "url": "https://github.com/resque/resque/pull/1865"}, {"name": "https://github.com/resque/resque/commit/7623b8dfbdd0a07eb04b19fb25b16a8d6f087f9a", "tags": ["x_refsource_MISC"], "url": "https://github.com/resque/resque/commit/7623b8dfbdd0a07eb04b19fb25b16a8d6f087f9a"}], "affected": [{"vendor": "resque", "product": "resque", "versions": [{"version": "< 2.6.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-12-22T20:10:10.964Z"}, "descriptions": [{"lang": "en", "value": "Resque is a Redis-backed Ruby library for creating background jobs, placing them on multiple queues, and processing them later. Reflected XSS issue occurs when /queues is appended with /\"><svg%20onload=alert(domain)>. This issue has been patched in version 2.6.0."}], "source": {"advisory": "GHSA-r9mq-m72x-257g", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T22:16:47.210Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/resque/resque/security/advisories/GHSA-r9mq-m72x-257g", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/resque/resque/security/advisories/GHSA-r9mq-m72x-257g"}, {"name": "https://github.com/resque/resque/pull/1865", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/resque/resque/pull/1865"}, {"name": "https://github.com/resque/resque/commit/7623b8dfbdd0a07eb04b19fb25b16a8d6f087f9a", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/resque/resque/commit/7623b8dfbdd0a07eb04b19fb25b16a8d6f087f9a"}]}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-50727", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-01-02T16:36:53.442840Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-23T16:17:43.099Z"}}]}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:resque:resque:*:*:*:*:*:ruby:*:*", "matchCriteriaId": "443F9594-AEFD-4F85-BFEF-5C7C70C44DF7", "versionEndExcluding": "2.6.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Resque is a Redis-backed Ruby library for creating background jobs, placing them on multiple queues, and processing them later. Reflected XSS issue occurs when /queues is appended with /\"><svg%20onload=alert(domain)>. This issue has been patched in version 2.6.0."}, {"lang": "es", "value": "Resque es una librer\u00eda Ruby respaldada por Redis para crear trabajos en segundo plano, colocarlos en varias colas y procesarlos m\u00e1s tarde. El problema de XSS reflejado ocurre cuando /queues se agrega con /\">. Este problema se solucion\u00f3 en la versi\u00f3n 2.6.0."}], "id": "CVE-2023-50727", "lastModified": "2024-11-21T08:37:13.413", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-12-22T21:15:07.690", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/resque/resque/commit/7623b8dfbdd0a07eb04b19fb25b16a8d6f087f9a"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/resque/resque/pull/1865"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/resque/resque/security/advisories/GHSA-r9mq-m72x-257g"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/resque/resque/commit/7623b8dfbdd0a07eb04b19fb25b16a8d6f087f9a"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/resque/resque/pull/1865"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/resque/resque/security/advisories/GHSA-r9mq-m72x-257g"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}