VulnerabilityModified
CVE-2023-26141
Versions of the package sidekiq before 7.1.3 are vulnerable to Denial of Service (DoS) due to insufficient checks in the dashboard-charts.js file.
MEDIUM 4.9EPSS 0.75%
Does this matter?
Lower severity and a low EPSS score (0.75%). Track it; it rarely justifies an emergency change on its own.
Description
Versions of the package sidekiq before 7.1.3 are vulnerable to Denial of Service (DoS) due to insufficient checks in the dashboard-charts.js file. An attacker can exploit this vulnerability by manipulating the localStorage value which will cause excessive polling requests.
- CVSS 3.1
- 4.9 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 0.75% probability · 53th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-400, CWE-345
- Affected
- contribsys/sidekiq
- Source
- report@snyk.io
References
- https://gist.github.com/keeganparr1/1dffd3c017339b7ed5371ed3d81e6b2aExploit
- https://github.com/sidekiq/sidekiq/blob/6-x/web/assets/javascripts/dashboard.js%23L6Broken Link
- https://github.com/sidekiq/sidekiq/commit/62c90d7c5a7d8a378d79909859d87c2e0702bf89Patch
- https://security.snyk.io/vuln/SNYK-RUBY-SIDEKIQ-5885107Third Party Advisory
- https://gist.github.com/keeganparr1/1dffd3c017339b7ed5371ed3d81e6b2aExploit
- https://github.com/sidekiq/sidekiq/blob/6-x/web/assets/javascripts/dashboard.js%23L6Broken Link
- https://github.com/sidekiq/sidekiq/commit/62c90d7c5a7d8a378d79909859d87c2e0702bf89Patch
- https://security.snyk.io/vuln/SNYK-RUBY-SIDEKIQ-5885107Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.