CVE-2023-22792
rubygem-actionpack: Denial of Service in Action Dispatch
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
A regular expression based DoS vulnerability in Action Dispatch <6.0.6.1,< 6.1.7.1, and <7.0.4.1. Specially crafted cookies, in combination with a specially crafted X_FORWARDED_HOST header can cause the regular expression engine to enter a state of catastrophic backtracking. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability All users running an affected release should either upgrade or use one of the workarounds immediately.
A flaw was found in the rubygem-actionpack. RubyGem's actionpack gem is vulnerable to a denial of service caused by a regular expression denial of service (ReDoS) flaw in the Action Dispatch module. By sending specially-crafted cookies with an X_FORWARDED_HOST header, a remote attacker could exploit this vulnerability to use large amounts of CPU and memory, resulting in a denial of service.
Multiple vulnerabilities were discovered in rails, the Ruby based server-side MVC web application framework, which could result in XSS, data disclosure and open redirect.
CVSS Scores
SSVC
- Decision:Attend
Timeline
- 2023-01-06 CVE Reserved
- 2023-02-09 CVE Published
- 2025-03-24 CVE Updated
- 2025-04-01 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-400: Uncontrolled Resource Consumption
- CWE-1333: Inefficient Regular Expression Complexity
CAPEC
References (5)
| URL | Tag | Source |
|---|---|---|
| https://security.netapp.com/advisory/ntap-20240202-0007 |
|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://discuss.rubyonrails.org/t/cve-2023-22792-possible-redos-based-dos-vulnerability-in-action-dispatch/82115 | 2024-02-02 |
| URL | Date | SRC |
|---|---|---|
| https://www.debian.org/security/2023/dsa-5372 | 2024-02-02 | |
| https://access.redhat.com/security/cve/CVE-2023-22792 | 2023-11-08 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2164800 | 2023-11-08 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | >= 3.0.0 < 6.0.6.1 Search vendor "Rubyonrails" for product "Rails" and version " >= 3.0.0 < 6.0.6.1" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | >= 6.1.0 < 6.1.7.1 Search vendor "Rubyonrails" for product "Rails" and version " >= 6.1.0 < 6.1.7.1" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | >= 7.0.0 < 7.0.4.1 Search vendor "Rubyonrails" for product "Rails" and version " >= 7.0.0 < 7.0.4.1" | - |
Affected
| ||||||