PT-2023-30739 · Rundeck · Rundeck

CVE-2023-48222 · Publicado 2023-11-16 · Atualizado 2023-11-25

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Rundeck versions 4.12.0 through 4.16.0

Description The issue allows authenticated users to access certain URL paths without necessary authorization checks, potentially enabling them to view or delete jobs. The affected URLs are: http[s]://[host]/context/rdJob/* and http[s]://[host]/context/api/*/incubator/jobs.

Recommendations For versions 4.12.0 through 4.16.0, upgrade to version 4.17.3 to resolve the issue. As a temporary workaround, consider blocking access to the vulnerable URLs at a load balancer level: http[s]://[host]/context/rdJob/* and http[s]://[host]/context/api/*/incubator/jobs.

Exploit

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2023-48222

GHSA-PHMW-JX86-X666

Produtos afetados

Rundeck

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/48xxx/CVE-2023-48222.json · Exploit
• https://github.com/rundeck/rundeck/security/advisories/GHSA-phmw-jx86-x666 · Aviso do Fabricante
• https://github.com/rundeck/rundeck · Nota
• https://t.me/latest_high_impact_cve/96 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-48222 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-48222 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-phmw-jx86-x666 · Aviso do Fabricante