CVE-2023-26141: sidekiq Denial of Service vulnerability
(updated )
Versions of the package sidekiq before 7.1.3 is vulnerable to Denial of Service (DoS) due to insufficient checks in the dashboard-charts.js file. An attacker can exploit this vulnerability by manipulating the localStorage value which will cause excessive polling requests.
References
- gist.github.com/keeganparr1/1dffd3c017339b7ed5371ed3d81e6b2a
- github.com/advisories/GHSA-3qc2-v3hp-6cv8
- github.com/sidekiq/sidekiq/blob/6-x/web/assets/javascripts/dashboard.js
- github.com/sidekiq/sidekiq/commit/62c90d7c5a7d8a378d79909859d87c2e0702bf89
- nvd.nist.gov/vuln/detail/CVE-2023-26141
- security.snyk.io/vuln/SNYK-RUBY-SIDEKIQ-5885107
Code Behaviors & Features
Detect and mitigate CVE-2023-26141 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →