Resource exhaustion in Contribsys Sidekiq
CVE-2022-23837
In api.rb in Sidekiq before 5.2.10 and 6.4.0, there is no limit on the number of days when requesting stats for the graph. This overloads the system, affecting the Web UI, and makes it unavailable to users.
EPSS: 0.053 (91.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Contribsys Sidekiq
- Debian Debian_linux — versions 9.0
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (Patch, Third Party Advisory)
- cve@mitre.org (Exploit, Third Party Advisory)
- cve@mitre.org (Patch, Third Party Advisory)
- cve@mitre.org (mailing-list, Mailing List, Third Party Advisory)
- cve@mitre.org (mailing-list)
Frequently asked questions
- What is CVE-2022-23837?
- CVE-2022-23837 is a high-severity vulnerability in Contribsys Sidekiq, classified under Allocation of Resources Without Limits or Throttling. CVSS score: 7.5/10. Published 2022-01-21.
- How severe is CVE-2022-23837?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2022-23837 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.