CVE-2022-44303: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

December 18, 2023

Resque Scheduler version 1.27.4 is vulnerable to Cross-site scripting (XSS). A remote attacker could inject javascript code to the “{schedule_job}” or “args” parameter in /resque/delayed/jobs/{schedule_job}?args={args_id} to execute javascript at client side.

References

github.com/advisories/GHSA-9hmq-fm33-x4xx
github.com/resque/resque-scheduler/security/advisories/GHSA-9hmq-fm33-x4xx
nvd.nist.gov/vuln/detail/CVE-2022-44303
trungvm.gitbook.io/cves/resque/resque-1.27.4-multiple-reflected-xss-in-resque-schedule-job

Detect and mitigate CVE-2022-44303 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →