PT-2022-19435 · Gocd · Gocd

Published 2022-05-20 · Updated 2022-06-06 · CVE-2022-29182

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions GoCD versions 19.11.0 through 21.4.0

Description GoCD is a continuous delivery server that is vulnerable to a Document Object Model (DOM)-based cross-site scripting attack via a pipeline run's Stage Details > Graphs tab. This could allow an attacker to steal a GoCD user's session cookies and/or execute malicious code in the user's context by abusing a messaging channel used for communication between the parent page and the stage details graph's iframe.

Recommendations For GoCD versions 19.11.0 through 21.4.0, update to GoCD 22.1.0 to resolve the issue. At the moment, there are no known workarounds for this issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-29182

GHSA-QCG6-4Q44-3589

Affected Products

Gocd

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29182.json · Exploit
• https://github.com/gocd/gocd/pull/10190/commits/a256d05de1445e6c77843f098581fc6a66fe4477 · Patch
• https://osv.dev/vulnerability/CVE-2022-29182 · Vendor Advisory
• https://gocd.org/releases/#22-1-0 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-29182 · Security Note
• https://github.com/gocd/gocd/security/advisories/GHSA-qcg6-4q44-3589 · Note
• https://github.com/gocd/gocd/releases/tag/22.1.0 · Note
• https://t.me/cvenotify/31163 · Telegram Post
• https://t.me/cibsecurity/43087 · Telegram Post