PT-2023-30317 · Rundeck · Rundeck

Fdevans · Publicado 2023-11-16 · Atualizado 2023-11-25 · CVE-2023-47112

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Rundeck versions prior to 4.17.3

Description The issue allows authenticated users to access certain URL paths without necessary authorization checks, providing a list of job names and groups for any project. The affected URLs are "http[s]://[host]/context/rdJob/" and "http[s]://[host]/context/api//incubator/jobs". The output of these endpoints only exposes the name of job groups and the jobs contained within the specified project, and the access does not allow changes to the information.

Recommendations For versions prior to 4.17.3, upgrade to version 4.17.3 to resolve the issue. As a temporary workaround, consider blocking access to the URLs "http[s]://[host]/context/rdJob/" and "http[s]://[host]/context/api//incubator/jobs" at a load balancer level.

Exploit

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2023-47112

GHSA-XVMV-4RX6-X6JX

Produtos afetados

Rundeck

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/47xxx/CVE-2023-47112.json · Exploit
• https://github.com/rundeck/rundeck/security/advisories/GHSA-xvmv-4rx6-x6jx · Aviso do Fabricante
• https://github.com/rundeck/rundeck/commit/8992879036a1ddacfca78559d823be0424796e7e · Nota
• https://github.com/rundeck/rundeck · Nota
• https://osv.dev/vulnerability/CVE-2023-47112 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-47112 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-xvmv-4rx6-x6jx · Aviso do Fabricante