VulnerabilityModified
CVE-2022-23837
In api.rb in Sidekiq before 5.2.10 and 6.4.0, there is no limit on the number of days when requesting stats for the graph.
HIGH 7.5EPSS 5.26%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (5.26%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
In api.rb in Sidekiq before 5.2.10 and 6.4.0, there is no limit on the number of days when requesting stats for the graph. This overloads the system, affecting the Web UI, and makes it unavailable to users.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 5.26% probability · 92th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-770
- Affected
- contribsys/sidekiq · debian/debian linux
- Source
- cve@mitre.org
References
- https://github.com/TUTUMSPACE/exploits/blob/main/sidekiq.mdExploit, Third Party Advisory
- https://github.com/mperham/sidekiq/commit/7785ac1399f1b28992adb56055f6acd88fd1d956Patch, Third Party Advisory
- https://github.com/rubysec/ruby-advisory-db/pull/495Patch, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/03/msg00015.htmlMailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/03/msg00011.html
- https://github.com/TUTUMSPACE/exploits/blob/main/sidekiq.mdExploit, Third Party Advisory
- https://github.com/mperham/sidekiq/commit/7785ac1399f1b28992adb56055f6acd88fd1d956Patch, Third Party Advisory
- https://github.com/rubysec/ruby-advisory-db/pull/495Patch, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/03/msg00015.htmlMailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/03/msg00011.html
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.