CVE-2023-50724
Resque vulnerable to reflected cross site scripting through pathname
Resque (pronounced like "rescue") is a Redis-backed library for creating background jobs, placing those jobs on multiple queues, and processing them later. resque-web in resque versions before 2.1.0 are vulnerable to reflected XSS through the current_queue parameter in the path of the queues endpoint. This issue has been patched in version 2.1.0.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Resque vulnerable to reflected cross site scripting through pathname
Resque (pronounced like "rescue") is a Redis-backed library for creating background jobs, placing those jobs on multiple queues, and processing them later. resque-web in resque versions before 2.1.0 are vulnerable to reflected XSS through the current_queue parameter in the path of the queues endpoint. This issue has been patched in version 2.1.0.
- Record
CVE-2023-50724- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2023-3286
Resque (pronounced like "rescue") is a Redis-backed library for creating background jobs, placing those jobs on multiple queues, and processing them later. resque-web in resque versions before 2.1.0 are vulnerable to reflected XSS through the current_queue parameter in the path of the queues endpoint. This issue has been patched in version 2.1.0.
- Record
EUVD-2023-3286- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-r8xx-8vm8-x6wj
Resque vulnerable to Reflected Cross Site Scripting through pathnames
Impact
resque-web in resque versions before 2.1.0 is vulnerable to reflected XSS through the current_queue parameter in the path of the queues endpoint.
Patches
v2.1.0
Workarounds
No known workarounds at this time. It is recommended to not click on 3rd party or untrusted links to the resque-web interface until you have patched your application.
References
https://github.com/resque/resque/issues/1679 https://github.com/resque/resque/pull/1687
- Record
GHSA-r8xx-8vm8-x6wj- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N - Weakness
- CWE-79, CWE-233
- Updated
- 2026-11-02
NVD
Resque (pronounced like "rescue") is a Redis-backed library for creating background jobs, placing those jobs on multiple queues, and processing them later. resque-web in resque versions before 2.1.0 are vulnerable to reflected XSS through the current_queue parameter in the path of the queues endpoint. This issue has been patched in version 2.1.0.
- Record
CVE-2023-50724- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N - CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Resque vulnerable to reflected cross site scripting through pathname
Resque (pronounced like "rescue") is a Redis-backed library for creating background jobs, placing those jobs on multiple queues, and processing them later. resque-web in resque versions before 2.1.0 are vulnerable to reflected XSS through the current_queue parameter in the path of the queues endpoint. This issue has been patched in version 2.1.0.
- Record
CVE-2023-50724- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-r8xx-8vm8-x6wj
Resque vulnerable to Reflected Cross Site Scripting through pathnames
Impact
resque-web in resque versions before 2.1.0 is vulnerable to reflected XSS through the current_queue parameter in the path of the queues endpoint.
Patches
v2.1.0
Workarounds
No known workarounds at this time. It is recommended to not click on 3rd party or untrusted links to the resque-web interface until you have patched your application.
References
https://github.com/resque/resque/issues/1679 https://github.com/resque/resque/pull/1687
- Record
GHSA-r8xx-8vm8-x6wj- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N - Weakness
- CWE-233, CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
resqueRubyGems |
before 2.1.0 | 2.1.0 |
resqueRubyGems |
before 2.1.0, plus listed versions 0.2.01.0.01.1.01.10.01.11.0 Show 45 moreShow less1.12.01.13.01.14.01.15.01.16.01.16.11.17.01.17.11.18.01.18.11.18.21.18.31.18.41.18.51.18.61.19.01.2.01.2.11.2.31.20.01.21.01.22.01.23.01.23.11.24.01.24.11.25.01.25.0.pre1.25.11.25.21.26.01.26.pre.01.27.01.27.11.27.21.27.31.27.41.3.01.3.11.4.01.5.01.5.11.5.21.6.01.6.1 |
2.1.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-50724 is a medium vulnerability (CVSS 6.3) in Resque, published December 18, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.48%, the 41st percentile. Fixed in resque 2.1.0.
References
github.com/resque/resque/security/advisories/GHSA-r8xx-8vm8-x6wj
nvd.nist.gov/vuln/detail/CVE-2023-50724
Left out here: 20 versions. The JSON record has them.