CVE-2023-26141 - OpenCVE

Versions of the package sidekiq before 7.1.3 are vulnerable to Denial of Service (DoS) due to insufficient checks in the dashboard-charts.js file. An attacker can exploit this vulnerability by manipulating the localStorage value which will cause excessive polling requests.

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

Vendors & Products
CPE Configurations

Vendors	Products
Contribsys	Sidekiq

Configuration 1 [-]

OR	cpe:2.3:a:contribsys:sidekiq::::::::
	cpe:2.3:a:contribsys:sidekiq::::::::

References

Link	Resource
https://gist.github.com/keeganparr1/1dffd3c017339b7ed5371ed3d81e6b2a	Exploit
https://github.com/sidekiq/sidekiq/blob/6-x/web/assets/javascripts/dashboard.js%23L6	Broken Link
https://github.com/sidekiq/sidekiq/commit/62c90d7c5a7d8a378d79909859d87c2e0702bf89	Patch
https://security.snyk.io/vuln/SNYK-RUBY-SIDEKIQ-5885107	Third Party Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: snyk

Published: 2023-09-14T05:00:00.986Z

Updated: 2023-09-14T05:00:00.986Z

Reserved: 2023-02-20T10:28:48.926Z

Link: CVE-2023-26141

JSON object: View

NVD Information

Status : Modified

Published: 2023-09-14T05:15:11.363

Modified: 2023-11-07T04:09:27.270

Link: CVE-2023-26141

JSON object: View

Redhat Information

No data.

CWE

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:contribsys:sidekiq:*:*:*:*:*:*:*:*", "matchCriteriaId": "825EBC88-1B2F-4264-816E-F1F455207FCF", "versionEndExcluding": "6.5.10", "vulnerable": true}, {"criteria": "cpe:2.3:a:contribsys:sidekiq:*:*:*:*:*:*:*:*", "matchCriteriaId": "0C9916BC-BC63-42B1-BBA9-3FAC86B9465E", "versionEndExcluding": "7.1.3", "versionStartIncluding": "7.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Versions of the package sidekiq before 7.1.3 are vulnerable to Denial of Service (DoS) due to insufficient checks in the dashboard-charts.js file. An attacker can exploit this vulnerability by manipulating the localStorage value which will cause excessive polling requests."}, {"lang": "es", "value": "Las versiones del paquete sidekiq anteriores a la 7.1.3 son vulnerables a la Denegaci\u00f3n de Servicio (DoS) debido a comprobaciones insuficientes en el archivo dashboard-charts.js. Un atacante puede aprovechar esta vulnerabilidad manipulando el valor de localStorage, lo que provocar\u00e1 peticiones excesivas."}], "id": "CVE-2023-26141", "lastModified": "2023-11-07T04:09:27.270", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "report@snyk.io", "type": "Secondary"}]}, "published": "2023-09-14T05:15:11.363", "references": [{"source": "report@snyk.io", "tags": ["Exploit"], "url": "https://gist.github.com/keeganparr1/1dffd3c017339b7ed5371ed3d81e6b2a"}, {"source": "report@snyk.io", "tags": ["Broken Link"], "url": "https://github.com/sidekiq/sidekiq/blob/6-x/web/assets/javascripts/dashboard.js%23L6"}, {"source": "report@snyk.io", "tags": ["Patch"], "url": "https://github.com/sidekiq/sidekiq/commit/62c90d7c5a7d8a378d79909859d87c2e0702bf89"}, {"source": "report@snyk.io", "tags": ["Third Party Advisory"], "url": "https://security.snyk.io/vuln/SNYK-RUBY-SIDEKIQ-5885107"}], "sourceIdentifier": "report@snyk.io", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-345"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-400"}], "source": "report@snyk.io", "type": "Secondary"}]}