{"id":"CVE-2022-44303","aliases":["EUVD-2023-3174","GHSA-9hmq-fm33-x4xx"],"status":"published","title":"Resque Scheduler Reflected XSS In Delayed Jobs View","description":"Resque Scheduler version 1.27.4 is vulnerable to Cross-site scripting (XSS). A remote attacker could inject javascript code to the \"{schedule_job}\" or \"args\" parameter in /resque/delayed/jobs/{schedule_job}?args={args_id} to execute javascript at client side.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00654,"percentile":0.51658,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2022-12-13T00:00:00Z","modified":"2026-07-09T01:17:55Z","fixes":[{"ecosystem":"RubyGems","package":"resque-scheduler","fixed_in":["4.10.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"resque-scheduler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.27.4"},{"fixed":"4.10.2"}]}]},{"source":"osv","ecosystem":"RubyGems","package":"resque-scheduler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.27.4"},{"fixed":"4.10.2"}]}],"versions":["2.0.0","2.0.0.a","2.0.0.b","2.0.0.c","2.0.0.d","2.0.0.e","2.0.0.g","2.0.0.h","2.0.1","2.1.0","2.1.1","2.2.0","2.3.0","2.3.1","2.4.0","2.5.0","2.5.1","2.5.2","2.5.3","2.5.4","2.5.5","3.0.0","3.1.0","4.0.0","4.1.0","4.10.0","4.10.1","4.2.0","4.2.1","4.3.0","4.3.1","4.4.0","4.5.0","4.6.0","4.7.0","4.8.0","4.9.0"]}],"products":[{"vendor":"resque-scheduler_project","product":"resque-scheduler"}],"references":[{"url":"https://trungvm.gitbook.io/cves/resque/resque-1.27.4-multiple-reflected-xss-in-resque-schedule-job","tags":["x_transferred","Exploit","Third Party Advisory","web"]},{"url":"https://github.com/resque/resque-scheduler/security/advisories/GHSA-9hmq-fm33-x4xx","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-44303","tags":["advisory"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/resque-scheduler/CVE-2022-44303.yml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-9hmq-fm33-x4xx"},{"url":"https://github.com/resque/resque-scheduler","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-44303","description":"Resque Scheduler version 1.27.4 is vulnerable to Cross-site scripting (XSS). A remote attacker could inject javascript code to the \"{schedule_job}\" or \"args\" parameter in /resque/delayed/jobs/{schedule_job}?args={args_id} to execute javascript at client side.","status":"published","published":"2022-12-13T00:00:00Z","modified":"2026-07-09T00:22:24.869Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:34:30.176321Z"}],"euvd":[{"id":"EUVD-2023-3174","description":"Resque Scheduler version 1.27.4 is vulnerable to Cross-site scripting (XSS). A remote attacker could inject javascript code to the \"{schedule_job}\" or \"args\" parameter in /resque/delayed/jobs/{schedule_job}?args={args_id} to execute javascript at client side.","status":"published","published":"2022-12-13T00:00:00Z","modified":"2026-07-09T00:22:24Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:20:07.281662Z"}],"ghsa":[{"id":"GHSA-9hmq-fm33-x4xx","title":"Resque Scheduler Reflected XSS In Delayed Jobs View","description":"### Impact\n\nResque Scheduler version 1.27.4 and above are affected by a cross-site scripting vulnerability. A remote attacker can inject javascript code to the \"{schedule_job}\" or \"args\" parameter in /resque/delayed/jobs/{schedule_job}?args={args_id} to execute javascript at client side.\n\n### Patches\n\nFixed in v4.10.2\n\n### Workarounds\n\nNo known workarounds at this time. It is recommended to not click on 3rd party or untrusted links to the resque-web interface until you have patched your application.\n\n### References\n* https://nvd.nist.gov/vuln/detail/CVE-2022-44303\n* https://github.com/resque/resque-scheduler/issues/761\n* https://github.com/resque/resque/issues/1885\n* https://github.com/resque/resque-scheduler/pull/780\n* https://github.com/resque/resque-scheduler/pull/783\n","status":"published","published":"2023-12-18T19:30:32Z","modified":"2024-01-03T15:56:07Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:37:28.753349Z"}],"nvd":[{"id":"CVE-2022-44303","description":"Resque Scheduler version 1.27.4 is vulnerable to Cross-site scripting (XSS). A remote attacker could inject javascript code to the \"{schedule_job}\" or \"args\" parameter in /resque/delayed/jobs/{schedule_job}?args={args_id} to execute javascript at client side.","status":"published","published":"2022-12-13T15:15:11.107Z","modified":"2026-07-09T01:17:55.68Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:07:33.649381Z"}],"osv":[{"id":"GHSA-9hmq-fm33-x4xx","title":"Resque Scheduler Reflected XSS In Delayed Jobs View","description":"### Impact\n\nResque Scheduler version 1.27.4 and above are affected by a cross-site scripting vulnerability. A remote attacker can inject javascript code to the \"{schedule_job}\" or \"args\" parameter in /resque/delayed/jobs/{schedule_job}?args={args_id} to execute javascript at client side.\n\n### Patches\n\nFixed in v4.10.2\n\n### Workarounds\n\nNo known workarounds at this time. It is recommended to not click on 3rd party or untrusted links to the resque-web interface until you have patched your application.\n\n### References\n* https://nvd.nist.gov/vuln/detail/CVE-2022-44303\n* https://github.com/resque/resque-scheduler/issues/761\n* https://github.com/resque/resque/issues/1885\n* https://github.com/resque/resque-scheduler/pull/780\n* https://github.com/resque/resque-scheduler/pull/783\n","status":"published","published":"2023-12-18T19:30:32Z","modified":"2024-02-16T08:14:44.627747Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:43.875515Z"}]}}