GHSA-3qc2-v3hp-6cv8

    Dashboard / Vulnerabilities / GHSA-3qc2-v3hp-6cv8

    GHSA-3qc2-v3hp-6cv8

    Published: 14 Sept 2023Last Modified: 16 Feb 2024

    Summary: sidekiq Denial of Service vulnerability

    Details: Versions of the package sidekiq before 7.1.3 and 6.5.10 are vulnerable to Denial of Service (DoS) due to insufficient checks in the dashboard-charts.js file. An attacker can exploit this vulnerability by manipulating the localStorage value which will cause excessive polling requests.

    References: https://nvd.nist.gov/vuln/detail/CVE-2023-26141, https://github.com/sidekiq/sidekiq/commit/62c90d7c5a7d8a378d79909859d87c2e0702bf89, https://gist.github.com/keeganparr1/1dffd3c017339b7ed5371ed3d81e6b2a, https://github.com/rubysec/ruby-advisory-db/blob/master/gems/sidekiq/CVE-2023-26141.yml, https://github.com/sidekiq/sidekiq, https://github.com/sidekiq/sidekiq/blob/6-x/Changes.md#6510, https://github.com/sidekiq/sidekiq/blob/6-x/web/assets/javascripts/dashboard.js#L6, https://github.com/sidekiq/sidekiq/blob/6-x/web/assets/javascripts/dashboard.js%23L6, https://security.snyk.io/vuln/SNYK-RUBY-SIDEKIQ-5885107

    Affected packages

    Package

    Name: sidekiq

    Purl: pkg:gem/sidekiq

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 7.0.0
    Fixed -7.1.3

    Affected versions

    7.0.0
    7.0.1
    7.0.2
    7.0.3
    7.0.4
    7.0.5
    7.0.6
    7.0.7
    7.0.8
    7.0.9

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-3qc2-v3hp-6cv8 | CVE-DB