TI-2024-16576 Aliases CVE-2024-25122 GHSA-cmh9-rx85-xj38

Cross-site Scripting sidekiq-unique-jobs UI server vulnerability

LOW 32CWE-79Published 2024-02-13 · Updated 2024-08-01

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting, Denial of service
Confidentiality · integrity · availability: Low · Low · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79 and CWE-400.

Summary

sidekiq-unique-jobs is an open source project which prevents simultaneous Sidekiq jobs with the same unique arguments to run. Specially crafted GET request parameters handled by any of the following endpoints of sidekiq-unique-jobs' "admin" web UI, allow a super-user attacker, or an unwitting, but authorized, victim, who has received a disguised / crafted link, to successfully execute malicious code, which could potentially steal cookies, session data, or local storage data from the app the sidekiq-unique-jobs web UI is mounted in. 1. `/changelogs`, 2. `/locks` or 3. `/expiring_locks`. This issue has been addressed in versions 7.1.33 and 8.0.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0053 45th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed sidekiq-unique-jobs (mhenrixon): 7.1.33, 8.0.7sidekiq-unique-jobs (RubyGems): 8.0.7, 7.1.33

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
mhenrixon	sidekiq-unique-jobs	before 7.1.33; 8.0.0 to before 8.0.7	7.1.33, 8.0.7	Patch available	CNA
—	sidekiq-unique-jobs (RubyGems)	8.0.0 to before 8.0.7	8.0.7	Patch available	GHSA-cmh9-rx85-xj38
—	sidekiq-unique-jobs (RubyGems)	6.0.0.rc7 to before 7.1.33	7.1.33	Patch available	GHSA-cmh9-rx85-xj38

sidekiq-unique-jobs Vendormhenrixon Affected before 7.1.33; 8.0.0 to before 8.0.7 Fixed in 7.1.33, 8.0.7 Patch available CNA
sidekiq-unique-jobs (RubyGems) Vendor— Affected 8.0.0 to before 8.0.7 Fixed in 8.0.7 Patch available GHSA-cmh9-rx85-xj38
sidekiq-unique-jobs (RubyGems) Vendor— Affected 6.0.0.rc7 to before 7.1.33 Fixed in 7.1.33 Patch available GHSA-cmh9-rx85-xj38

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:mhenrixon:sidekiq-unique-jobs::::::::	before 7.1.33; 8.0.0 to before 8.0.7	Vulnerable	mhenrixon

cpe:2.3:a:mhenrixon:sidekiq-unique-jobs:*:*:*:*:*:*:*:* Versions before 7.1.33; 8.0.0 to before 8.0.7 Vulnerable ·mhenrixon

Remediation

Fix · CNA sidekiq-unique-jobs (mhenrixon) Fixed in 7.1.33, 8.0.7
Fix · GHSA-cmh9-rx85-xj38 sidekiq-unique-jobs (RubyGems) Fixed in 8.0.7 Advisory →
Fix · GHSA-cmh9-rx85-xj38 sidekiq-unique-jobs (RubyGems) Fixed in 7.1.33 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2024-25122
2026-10-03 Alias added: GHSA-cmh9-rx85-xj38

References

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences