PT-2023-30739 · Rundeck · Rundeck

Published 2023-11-16 · Updated 2023-11-25 · CVE-2023-48222

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Rundeck versions 4.12.0 through 4.16.0

Description The issue allows authenticated users to access certain URL paths without necessary authorization checks, potentially enabling them to view or delete jobs. The affected URLs are: http[s]://[host]/context/rdJob/* and http[s]://[host]/context/api/*/incubator/jobs.

Recommendations For versions 4.12.0 through 4.16.0, upgrade to version 4.17.3 to resolve the issue. As a temporary workaround, consider blocking access to the vulnerable URLs at a load balancer level: http[s]://[host]/context/rdJob/* and http[s]://[host]/context/api/*/incubator/jobs.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2023-48222

GHSA-PHMW-JX86-X666

Affected Products

Rundeck

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/48xxx/CVE-2023-48222.json · Exploit
• https://github.com/rundeck/rundeck/security/advisories/GHSA-phmw-jx86-x666 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-48222 · Security Note
• https://osv.dev/vulnerability/CVE-2023-48222 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-phmw-jx86-x666 · Vendor Advisory
• https://github.com/rundeck/rundeck · Note
• https://t.me/latest_high_impact_cve/96 · Telegram Post