PT-2023-21862 · Unknown+2 · Postgresql+3

Infoatb · Publicado 2023-03-27 · Atualizado 2023-04-03 · CVE-2023-28630

Positive Technologies (AI Summary)

CVSS v3.1

4.2

Média

Vetor base

AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions GoCD versions 20.5.0 through 23.1.0

Description The issue arises when the server environment is not correctly configured to provide access to the relevant PostgreSQL or MySQL backup tools, potentially leaking database access credentials to admin alerts on the GoCD user interface. This occurs if the GoCD server host is misconfigured to have backups enabled but lacks access to the pg dump or mysqldump utility tools for the configured database type. The vulnerability does not affect backups of the default on-disk H2 database.

Recommendations For GoCD versions 20.5.0 through 23.1.0, upgrade to GoCD 23.1.0 to resolve the issue. For users unable to upgrade, consider disabling backups as a temporary workaround. Alternatively, ensure that the required pg dump (PostgreSQL) or mysqldump (MySQL) binaries are available on the GoCD server when backups are triggered.

Exploit

Correção

Insertion into Log File

Enumeração de Fraquezas

CWE-532

Identificadores relacionados

CVE-2023-28630

GHSA-P95W-GH78-QJMV

Produtos afetados

Gocd

H2

Mysql Server

Postgresql

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28630.json · Exploit
• https://github.com/gocd/gocd/security/advisories/GHSA-p95w-gh78-qjmv · Aviso do Fabricante
• https://github.com/gocd/gocd/commit/6545481e7b36817dd6033bf614585a8db242070d · Correção
• https://github.com/gocd/gocd/releases/tag/23.1.0 · Nota
• https://t.me/cibsecurity/60838 · Publicação no Telegram
• https://gocd.org/releases/#23-1-0 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-28630 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-28630 · Aviso do Fabricante