Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2023-28362 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

The redirect_to method in Rails allows provided values to contain characters which are not legal in an HTTP header value. This results in the potential for downstream services which enforce RFC compliance on HTTP response headers to remove the assigned Location header.

Metrics

CVSS 3.x Severity and Vector Strings:

NDDVolerionCVSS-B:5.4 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CNA: CISA-ADPCVSS-B:4 MEDIUMVector:CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://security.netapp.com/advisory/ntap-20250502-0009/ CVEAdvisoryRemedy
https://discuss.rubyonrails.org/t/cve-2023-28362-possible-xss-via-user-supplied-values-to-redirect-to/83132 [email protected]Mailing ListTechnical DescriptionVendor
https://github.com/advisories/GHSA-4g8v-vg43-wpgf [email protected]AdvisoryRemedy
https://github.com/rails/rails/commit/1c3f93d1e90a3475f9ae2377ead25ccf11f71441 [email protected]Source CodeVendor
https://github.com/rails/rails/commit/69e37c84e3f77d75566424c7d0015172d6a6fac5 [email protected]Source CodeVendor

Weakness Enumeration

CWE-IDCWE NameSource
CWE-116Improper Encoding or Escaping of OutputCISA-ADP

Affected Products

ProductVersions
Ruby on Rails
< 6.1.7.4
>= 7.0.0, < 7.0.5.1

CPE

  • cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:*
  • cpe:2.3:a:rubyonrails:ruby_on_rails:*:*:*:*:*:*:*:*

Remediation

  • Upgrade: 6.1.7.4moderate effort
  • Upgrade: 7.0.5.1moderate effort
  • Mitigation:low effort

    Avoid providing user-supplied URLs with arbitrary schemes to the redirect_to method.

NetApp
All versions

CPE

  • cpe:2.3:a:ibm:network_appliance_data_ontap:*:*:*:*:*:*:*:*
  • cpe:2.3:a:netapp:active_iq:*:*:*:*:*:*:*:*
  • cpe:2.3:a:netapp:altavault:*:*:*:*:*:*:*:*
  • cpe:2.3:a:netapp:astra_trident:*:*:*:*:*:*:*:*
  • cpe:2.3:a:netapp:bluexp:*:*:*:*:*:*:*:*
  • cpe:2.3:a:netapp:brocade_network_advisor:*:*:*:*:*:*:*:*
  • cpe:2.3:a:netapp:cloud_backup:*:*:*:*:*:*:*:*
  • cpe:2.3:a:netapp:cloud_manager:*:*:*:*:*:*:*:*
  • cpe:2.3:a:netapp:clustered_data_ontap:*:*:*:*:*:*:*:*
  • cpe:2.3:a:netapp:data_infrastructure_insights_acquisition_unit:*:*:*:*:*:*:*:*
  • cpe:2.3:a:netapp:data_ontap:*:*:*:*:*:*:*:*
  • cpe:2.3:a:netapp:data_ontap:*:*:*:*:*:7-mode:*:*
  • cpe:2.3:a:netapp:data_ontap_edge:*:*:*:*:*:*:*:*
  • cpe:2.3:a:netapp:element_software:*:*:*:*:*:*:*:*
  • cpe:2.3:a:netapp:e-series_santricity_management:*:*:*:*:*:*:*:*
  • cpe:2.3:a:netapp:e-series_santricity_management:*:*:*:*:*:vcenter:*:*
  • cpe:2.3:a:netapp:e-series_santricity_management:*:*:*:*:*:vmware_sra:*:*
  • cpe:2.3:a:netapp:e-series_santricity_management:*:*:*:*:*:vmware_vasa:*:*
  • cpe:2.3:a:netapp:e-series_santricity_management:*:*:*:*:*:vmware_vcenter:*:*
  • cpe:2.3:a:netapp:e-series_santricity_unified_manager:*:*:*:*:*:*:*:*
  • cpe:2.3:a:netapp:hci:*:*:*:*:*:*:*:*
  • cpe:2.3:a:netapp:hyper_converged_infrastructure:*:*:*:*:*:*:*:*
  • cpe:2.3:a:netapp:max_data:*:*:*:*:*:*:*:*
  • cpe:2.3:a:netapp:netapp_plug-in:*:*:*:*:*:*:*:*
  • cpe:2.3:a:netapp:netapp_xcp_smb:*:*:*:*:*:*:*:*
  • cpe:2.3:a:netapp:netcache:*:*:*:*:*:*:*:*
  • cpe:2.3:a:netapp:nextgen_api:*:*:*:*:*:*:*:*
  • cpe:2.3:a:netapp:ontap:*:*:*:*:*:*:*:*
  • cpe:2.3:a:netapp:ontap_9:*:*:*:*:*:*:*:*
  • cpe:2.3:a:netapp:ontap_tools:*:*:*:*:*:vmware_vsphere:*:*
  • cpe:2.3:a:netapp:os_controller:*:*:*:*:*:*:*:*
  • cpe:2.3:a:netapp:santricity_unified_manager:*:*:*:*:*:*:*:*
  • cpe:2.3:a:netapp:snapdriver:*:*:*:*:*:unix:*:*
  • cpe:2.3:a:netapp:snapmanager:*:*:*:*:*:*:*:*
  • cpe:2.3:a:netapp:snapmanager:*:*:*:*:*:hyper-v:*:*
  • cpe:2.3:a:netapp:snapmanager:*:*:*:*:*:oracle:*:*
  • cpe:2.3:a:netapp:snapmanager:*:*:*:*:*:sap:*:*
  • cpe:2.3:a:netapp:snapprotect:*:*:*:*:*:*:*:*
  • cpe:2.3:a:netapp:solidfire:*:*:*:*:*:*:*:*
  • cpe:2.3:a:netapp:steelstore:*:*:*:*:*:*:*:*
  • cpe:2.3:a:netapp:storage_encryption:*:*:*:*:*:*:*:*
  • cpe:2.3:a:netapp:storagegrid:*:*:*:*:*:*:*:*
  • cpe:2.3:a:netapp:system_manager:*:*:*:*:*:*:*:*
  • cpe:2.3:a:netapp:system_setup:*:*:*:*:*:*:*:*
  • cpe:2.3:a:netapp:trident:*:*:*:*:*:*:*:*
  • cpe:2.3:a:netapp:virtual_file_mangemer:*:*:*:*:*:*:*:*
  • cpe:2.3:a:netapp:virtual_storage_console:*:*:*:*:*:*:*:*
  • cpe:2.3:a:netapp:virtual_storage_console:*:*:*:*:*:vmware_vsphere:*:*
  • cpe:2.3:a:netapp:virtual_storage_console:*:*:*:*:*:vsphere:*:*
  • cpe:2.3:h:netapp:500f:*:*:*:*:*:*:*:*
  • cpe:2.3:h:netapp:8300:*:*:*:*:*:*:*:*
  • cpe:2.3:h:netapp:8700:*:*:*:*:*:*:*:*
  • cpe:2.3:h:netapp:a220:*:*:*:*:*:*:*:*
  • cpe:2.3:h:netapp:a250:*:*:*:*:*:*:*:*
  • cpe:2.3:h:netapp:a320:*:*:*:*:*:*:*:*
  • cpe:2.3:h:netapp:a400:*:*:*:*:*:*:*:*
  • cpe:2.3:h:netapp:a700s:*:*:*:*:*:*:*:*
  • cpe:2.3:h:netapp:a800:*:*:*:*:*:*:*:*
  • cpe:2.3:h:netapp:aff_500f:*:*:*:*:*:*:*:*
  • cpe:2.3:h:netapp:aff_8300:*:*:*:*:*:*:*:*
  • cpe:2.3:h:netapp:aff_a200:*:*:*:*:*:*:*:*
  • cpe:2.3:h:netapp:aff_a300:*:*:*:*:*:*:*:*
  • cpe:2.3:h:netapp:aff_a320:*:*:*:*:*:*:*:*
  • cpe:2.3:h:netapp:aff_a400:*:*:*:*:*:*:*:*
  • cpe:2.3:h:netapp:aff_a700:*:*:*:*:*:*:*:*
  • cpe:2.3:h:netapp:aff_a700s:*:*:*:*:*:*:*:*
  • cpe:2.3:h:netapp:affa900:*:*:*:*:*:*:*:*
  • cpe:2.3:h:netapp:aff_c190:*:*:*:*:*:*:*:*
  • cpe:2.3:h:netapp:c190:*:*:*:*:*:*:*:*
  • cpe:2.3:h:netapp:c250:*:*:*:*:*:*:*:*
  • cpe:2.3:h:netapp:cn1610:*:*:*:*:*:*:*:*
  • cpe:2.3:h:netapp:ef600a:*:*:*:*:*:*:*:*
  • cpe:2.3:h:netapp:fabric-attached_storage_8300:*:*:*:*:*:*:*:*
  • cpe:2.3:h:netapp:fabric-attached_storage_8700:*:*:*:*:*:*:*:*
  • cpe:2.3:h:netapp:fabric-attached_storage_a400:*:*:*:*:*:*:*:*
  • cpe:2.3:h:netapp:fas2600:*:*:*:*:*:*:*:*
  • cpe:2.3:h:netapp:fas26x0:*:*:*:*:*:*:*:*
  • cpe:2.3:h:netapp:fas2720:*:*:*:*:*:*:*:*
  • cpe:2.3:h:netapp:fas2750:*:*:*:*:*:*:*:*
  • cpe:2.3:h:netapp:fas2820:*:*:*:*:*:*:*:*
  • cpe:2.3:h:netapp:fas_500f:*:*:*:*:*:*:*:*
  • cpe:2.3:h:netapp:fas500f:*:*:*:*:*:*:*:*
  • cpe:2.3:h:netapp:fas8200:*:*:*:*:*:*:*:*
  • cpe:2.3:h:netapp:fas8300:*:*:*:*:*:*:*:*
  • cpe:2.3:h:netapp:fas_8700:*:*:*:*:*:*:*:*
  • cpe:2.3:h:netapp:fas8700:*:*:*:*:*:*:*:*
  • cpe:2.3:h:netapp:fas9000:*:*:*:*:*:*:*:*
  • cpe:2.3:h:netapp:fas9500:*:*:*:*:*:*:*:*
  • cpe:2.3:h:netapp:fas_a250:*:*:*:*:*:*:*:*
  • cpe:2.3:h:netapp:fas_a400:*:*:*:*:*:*:*:*
  • cpe:2.3:h:netapp:h300e:*:*:*:*:*:*:*:*
  • cpe:2.3:h:netapp:h300s:*:*:*:*:*:*:*:*
  • cpe:2.3:h:netapp:h410c:*:*:*:*:*:*:*:*
  • cpe:2.3:h:netapp:h410s:*:*:*:*:*:*:*:*
  • cpe:2.3:h:netapp:h500e:*:*:*:*:*:*:*:*
  • cpe:2.3:h:netapp:h500s:*:*:*:*:*:*:*:*
  • cpe:2.3:h:netapp:h610c:*:*:*:*:*:*:*:*
  • cpe:2.3:h:netapp:h610s:*:*:*:*:*:*:*:*
  • cpe:2.3:h:netapp:h615c:*:*:*:*:*:*:*:*
  • cpe:2.3:h:netapp:h700e:*:*:*:*:*:*:*:*
  • cpe:2.3:h:netapp:h700s:*:*:*:*:*:*:*:*
  • cpe:2.3:h:netapp:storagegrid:*:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:8700_firmware:*:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:a220_firmware:*:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:a250_firmware:*:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:a320_firmware:*:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:a400_firmware:*:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:a800_firmware:*:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:aff_500f_firmware:*:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:aff_8300_firmware:*:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:aff_a200_firmware:*:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:aff_a300_firmware:*:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:aff_a320_firmware:*:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:aff_a400_firmware:*:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:aff_a700_firmware:*:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:aff_a700s_firmware:*:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:aff_c190_firmware:*:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:bh500s_firmware:*:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:brocade_fabric_os:*:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:c190_firmware:*:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:c250_firmware:*:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:cluster_data_ontap:*:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:clustered_data_ontap:*:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:cn1610_firmware:*:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:data_ontap:*:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:data_ontap:*:*:*:*:*:7-mode:*:*
  • cpe:2.3:o:netapp:ef600a_firmware:*:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:element_os:*:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:fabric-attached_storage_8300_firmware:*:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:fabric-attached_storage_8700_firmware:*:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:fabric-attached_storage_a400_firmware:*:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:fas2600_firmware:*:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:fas26x0_firmware:*:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:fas2720_firmware:*:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:fas2750_firmware:*:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:fas_500f_firmware:*:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:fas500f_firmware:*:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:fas8200_firmware:*:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:fas8300_firmware:*:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:fas_8700_firmware:*:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:fas8700_firmware:*:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:fas9000_firmware:*:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:fas9500_firmware:*:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:fas_a250_firmware:*:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:fas_a400_firmware:*:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:fas_bios:*:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:h300e_firmware:*:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:h300s_firmware:*:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:h410c_firmware:*:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:h410s_firmware:*:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:h500e_firmware:*:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:h500s_firmware:*:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:h610c_firmware:*:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:h610s_firmware:*:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:h615c_firmware:*:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:h700e_firmware:*:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:h700s_firmware:*:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:storagegrid_firmware:*:*:*:*:*:*:*:*

Remediation

  • Mitigation:low effort

    Avoid providing user-supplied URLs with arbitrary schemes to the redirect_to method.

Change History

5 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2023-28362
NVD Published Date:
Jan 9, 2025
NVD Last Modified:
Jun 17, 2026
Source:
[email protected]
CVE-2023-28362 Details - Not Deferred