-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from two functions that read the localStorage.sidekiqTimeInterval value without proper validation. The RealtimeChart constructor in dashboard-charts.js directly used the parsed value for polling delays, while scheduleLivePoll in application.js scheduled polling based on the unvalidated value. The GitHub patch explicitly adds checks (ti < 2000 → ti = 2000) to both locations, confirming these were the vulnerable points. The attacker's ability to manipulate localStorage to set low values aligns with the CWE-400 (Uncontrolled Resource Consumption) and CWE-345 (Insufficient Verification) descriptions.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| sidekiq | rubygems | >= 7.0.0, < 7.1.3 | 7.1.3 |
| sidekiq | rubygems | < 6.5.10 | 6.5.10 |
A Semantic Attack on Google Gemini - Read the Latest Research