PT-2023-30317 · Rundeck · Rundeck

Fdevans · Published 2023-11-16 · Updated 2023-11-25 · CVE-2023-47112

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Rundeck versions prior to 4.17.3

Description The issue allows authenticated users to access certain URL paths without necessary authorization checks, providing a list of job names and groups for any project. The affected URLs are "http[s]://[host]/context/rdJob/" and "http[s]://[host]/context/api//incubator/jobs". The output of these endpoints only exposes the name of job groups and the jobs contained within the specified project, and the access does not allow changes to the information.

Recommendations For versions prior to 4.17.3, upgrade to version 4.17.3 to resolve the issue. As a temporary workaround, consider blocking access to the URLs "http[s]://[host]/context/rdJob/" and "http[s]://[host]/context/api//incubator/jobs" at a load balancer level.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2023-47112

GHSA-XVMV-4RX6-X6JX

Affected Products

Rundeck

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/47xxx/CVE-2023-47112.json · Exploit
• https://github.com/rundeck/rundeck/security/advisories/GHSA-xvmv-4rx6-x6jx · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-47112 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-47112 · Security Note
• https://osv.dev/vulnerability/GHSA-xvmv-4rx6-x6jx · Vendor Advisory
• https://github.com/rundeck/rundeck/commit/8992879036a1ddacfca78559d823be0424796e7e · Note
• https://github.com/rundeck/rundeck · Note