Rubysec

Providing security resources for the Ruby community.
Follow us @rubysec or email us via info at rubysec.com

Advisory Archive

Back

---
gem: delayed_job_web
date: 2018-01-10
url: https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0449
cve: 2017-12097
title: delayed_job_web ruby gem XSS vulnerability via `queues` parameter
description: |
  An exploitable cross site scripting (XSS) vulnerability exists in the
  filter functionality of the delayed_job_web ruby gem. A specially crafted
  URL can cause an XSS flaw resulting in an attacker being able to execute arbitrary
  javascript on the victim's browser. An attacker can phish an authenticated user
  to trigger this vulnerability.
cvss_v3: '6.1'
patched_versions:
- ">= 1.4.2"