PT-2023-21860 · Gocd · Gocd

Published 2023-03-27 · Updated 2023-04-03 · CVE-2023-28629

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions GoCD versions prior to 23.1.0

Description The issue is a stored XSS vulnerability, where pipeline configuration with a malicious pipeline label configuration can affect browser display of pipeline runs generated from that configuration. An attacker with permissions to configure pipelines could include JavaScript elements within the label template, causing the vulnerability to be triggered for users viewing the Value Stream Map or Job Details for runs of the affected pipeline. This could allow attackers to perform arbitrary actions within the victim's browser context.

Recommendations For GoCD versions prior to 23.1.0, upgrade to version 23.1.0 to resolve the issue. As a temporary workaround, consider restricting access to configure pipeline labels to minimize the risk of exploitation. Avoid using the label template in pipeline configurations until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-28629

GHSA-3VVG-GJFR-Q9VM

Affected Products

Gocd

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28629.json · Exploit
• https://github.com/gocd/gocd/security/advisories/GHSA-3vvg-gjfr-q9vm · Vendor Advisory
• https://github.com/gocd/gocd/commit/95f758229d419411a38577608709d8552cccf193 · Patch
• https://github.com/gocd/gocd/commit/c6aa644973b034305bbe9ea34b010dcf5b5790ce · Patch
• https://osv.dev/vulnerability/CVE-2023-28629 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-28629 · Security Note
• https://github.com/gocd/gocd/releases/tag/23.1.0 · Note
• https://gocd.org/releases/#23-1-0 · Note
• https://docs.gocd.org/current/configuration/pipeline_labeling.html · Note
• https://t.me/cibsecurity/60833 · Telegram Post