CVE-2022-44303

MediumCVSS 6.1

Published: 13/12/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.62%

46th percentile - higher than 46% of all known CVEs

Summary

Resque Scheduler version 1.27.4 is vulnerable to Cross-site scripting (XSS). A remote attacker can inject JavaScript code into the "schedule_job" or "args" parameters in the /resque/delayed/jobs/{schedule_job}?args={args_id} endpoint, leading to client-side script execution.

Risk Assessment

The risk involves potential execution of malicious JavaScript in the administrator's browser, which could lead to session theft, account takeover, or sensitive data leakage.

Recommendation

Immediately upgrade Resque Scheduler to the latest version that includes a fix for this XSS vulnerability. Additionally, implement input validation and sanitization for all user-supplied data.

Original NVD description (English source)

Resque Scheduler version 1.27.4 is vulnerable to Cross-site scripting (XSS). A remote attacker could inject javascript code to the "{schedule_job}" or "args" parameter in /resque/delayed/jobs/{schedule_job}?args={args_id} to execute javascript at client side.