PT-2022-23177 · Gocd · Gocd

Published 2022-09-07 · Updated 2022-09-16 · CVE-2022-36088

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions GoCD versions prior to 22.2.0

Description GoCD is a continuous delivery server. The issue arises from inadequate permission restrictions during Windows installations of GoCD server or agent installers outside of the default location. This could allow a malicious user with local access to modify executables or components of the installation. The issue does not affect zip file-based installs, installations to other platforms, or installations inside Program Files or Program Files (x86).

Recommendations For versions prior to 22.2.0, update to GoCD 22.2.0 or later to resolve the issue. As a temporary workaround, if the server or agent is installed outside of Program Files (x86), verify the permissions of the Server or Agent installation directory to ensure the Everyone user group does not have Full Control, Modify, or Write permissions.

Exploit

Fix

Improper Access Control

Improper Privilege Management

Weakness Enumeration

CWE-284

CWE-269

Related Identifiers

CVE-2022-36088

GHSA-GPV4-XQHC-5VCJ

Affected Products

Gocd

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36088.json · Exploit
• https://github.com/gocd/gocd/commit/96add9605096ab50c5cd4c229be1d503aff506a6 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-36088 · Security Note
• https://osv.dev/vulnerability/CVE-2022-36088 · Vendor Advisory
• https://github.com/gocd/gocd/security/advisories/GHSA-gpv4-xqhc-5vcj · Note
• https://github.com/gocd/gocd/releases/tag/22.2.0 · Note
• https://t.me/cibsecurity/49421 · Telegram Post
• https://gocd.org/releases/#22-2-0 · Note