Sidekiq is simple, efficient background processing for Ruby. Sidekiq is reflected XSS vulnerability. The value of substr parameter is reflected in the response without any encoding, allowing an attacker to inject Javascript code into the response of the application. An attacker could exploit it to target users of the Sidekiq Web UI. Moreover, if other applications are deployed on the same domain or website as Sidekiq, users of those applications could also be affected, leading to a broader scope of compromise. Potentially compromising their accounts, forcing the users to perform sensitive actions, stealing sensitive data, performing CORS attacks, defacement of the web application, etc. This issue has been patched in version 7.2.4.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Sidekiq is simple, efficient background processing for Ruby. Sidekiq is reflected XSS vulnerability. The     value of substr parameter is reflected in the response without any encoding, allowing an attacker to     inject Javascript code into the response of the application. An attacker could exploit it to target users     of the Sidekiq Web UI. Moreover, if other applications are deployed on the same domain or website as     Sidekiq, users of those applications could also be affected, leading to a broader scope of compromise.
    Potentially compromising their accounts, forcing the users to perform sensitive actions, stealing     sensitive data, performing CORS attacks, defacement of the web application, etc. This issue has been     patched in version 7.2.4. (CVE-2024-32887)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Sidekiq is simple, efficient background processing for Ruby. Sidekiq is reflected XSS vulnerability. The
    value of substr parameter is reflected in the response without any encoding, allowing an attacker to
    inject Javascript code into the response of the application. An attacker could exploit it to target users
    of the Sidekiq Web UI. Moreover, if other applications are deployed on the same domain or website as
    Sidekiq, users of those applications could also be affected, leading to a broader scope of compromise.
    Potentially compromising their accounts, forcing the users to perform sensitive actions, stealing
    sensitive data, performing CORS attacks, defacement of the web application, etc. This issue has been
    patched in version 7.2.4. (CVE-2024-32887)

ID	Name	Product	Family	Type	Severity
256245	Linux Distros Unpatched Vulnerability : CVE-2024-32887	Nessus	Misc.	Local	medium
417917	SCA: security update for sidekiq (GHSA-q655-3pj8-9fxq)	Tenable Cloud Security	SCA Checks	Local	medium
417917	SCA: security update for sidekiq (GHSA-q655-3pj8-9fxq)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2024-32887

medium

Tenable Plugins

medium

medium

medium