CVE-2023-46950: contribsys sidekiq
Vulnerability summary
CVE-2023-46950 is a medium (CVSS 6.1) vulnerability in contribsys sidekiq. EPSS estimates a 0.60% chance of exploitation in the next 30 days, higher than 48.4% of scored vulnerabilities. 1 public exploit is recorded.
Not severe (CVSS 6.1, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Timeline
- 01-03-2024PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
Cross Site Scripting vulnerability in Contribsys Sidekiq v.6.5.8 allows a remote attacker to obtain sensitive information via a crafted payload to the uniquejobs function.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · RubygemsEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- NVDNIST6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS trend
Probability
0.60%
Chance of exploitation in the next 30 days
Percentile
48%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.60% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundSidekiq Unique Jobs
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.
Contribsys1 product
- sidekiq6.5.8
Mhenrixon1 product
- sidekiq-unique-jobs< 7.1.33 | ≥ 8.0.0, < 8.0.7
RubyGems1 product
- sidekiq-unique-jobs≥ 8.0.0, < 8.0.7 | ≥ 6.0.0.rc7, < 7.1.33 | < 7.1.33
3 vendors · 3 products
References
13 links- github.com/mhenrixon/sidekiq-unique-jobs/security/advisories/GHSA-cmh9-rx85-xj38WEBExploitThird Party AdvisoryVendor Advisory
- www.mgm-sp.com/cve/sidekiq-unique-jobs-reflected-xss-cve-2023-46950-cve-2023-46951WEBThird Party Advisory
