Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

RubyGems package

resque-scheduler

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.3RubyGemsPublished

    Resque Scheduler Reflected XSS In Delayed Jobs View

    CVE-2022-44303 · GHSA-9hmq-fm33-x4xx

    Affected
    • RubyGems resque-scheduler >= 1.27.4, < 4.10.2
    Fixed in
    4.10.2· Vendor fix available
    Issue
    Impact Resque Scheduler version 1.27.4 and above are affected by a cross-site scripting vulnerability. A remote attacker can inject javascript code to the "{schedulejob}" or "args" parameter in /resque/delayed/jobs/{schedulejob}?args={argsid} to execute javascript at client side. Patches Fixed in v4.10.2 Workarounds No known workarounds at this time. It is recommended to not click on 3rd party or untrusted links to the resque-web interface until you have patched your application. References https://nvd.nist.gov/vuln/detail/CVE-2022-44303 https://github.com/resque/resque-scheduler/issues/761 https://github.com/resque/resque/issues/1885 https://github.com/resque/resque-scheduler/pull/780 https://github.com/resque/resque-scheduler/pull/783

    Recommended action: Upgrade to 4.10.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →