PT-2022-19436 · Gocd · Gocd

Chadlwilson · Published 2022-05-20 · Updated 2022-06-06 · CVE-2022-29183

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions GoCD versions 20.2.0 through 21.4.0

Description GoCD is a continuous delivery server. The issue concerns reflected cross-site scripting via abuse of the pipeline comparison function's error handling to render arbitrary HTML into the returned page. This could allow an attacker to trick a victim into executing code, which would allow the attacker to operate on, or gain control over the same resources as the victim had access to.

Recommendations For GoCD versions 20.2.0 through 21.4.0, update to GoCD 21.4.0 to resolve the issue. As a temporary workaround, consider blocking access to "/go/compare/.*" prior to the GoCD Server via a reverse proxy, web application firewall, or equivalent, to prevent use of the pipeline comparison function.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-29183

GHSA-3VVQ-Q4QV-X2GF

Affected Products

Gocd

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29183.json · Exploit
• https://github.com/gocd/gocd/pull/9829/commits/bda81084c0401234b168437cf35a63390e3064d1 · Patch
• https://gocd.org/releases/#21-4-0 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-29183 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-29183 · Security Note
• https://github.com/gocd/gocd/releases/tag/21.4.0 · Note
• https://github.com/gocd/gocd/security/advisories/GHSA-3vvq-q4qv-x2gf · Note
• https://t.me/cvenotify/31162 · Telegram Post
• https://t.me/cibsecurity/43080 · Telegram Post