Medium severity · published Jan 9, 2025
CVE-2023-28362
The redirect_to method in Rails allows provided values to contain characters which are not legal in an HTTP header value
4.0
CVSS
0.3%
EPSS
No
On KEV
Description
The redirect_to method in Rails allows provided values to contain characters which are not legal in an HTTP header value. This results in the potential for downstream services which enforce RFC compliance on HTTP response headers to remove the assigned Location header.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AP
Action Pack · Rails
7.0.5.1 before 7.0.5.1; 6.1.7.4 before 6.1.7.4 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-28362
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-28362
discuss.rubyonrails.org
https://discuss.rubyonrails.org/t/cve-2023-28362-possible-xss-via-user-supplied-values-to-redirect-to/83132
github.com
https://github.com/advisories/GHSA-4g8v-vg43-wpgf
github.com
https://github.com/rails/rails/commit/1c3f93d1e90a3475f9ae2377ead25ccf11f71441
github.com
https://github.com/rails/rails/commit/69e37c84e3f77d75566424c7d0015172d6a6fac5
security.netapp.com
https://security.netapp.com/advisory/ntap-20250502-0009/