PT-2025-1147 · Gocd · Gocd

Baiyecha404 · Published 2025-01-03 · Updated 2025-08-01 · CVE-2024-56320

Positive Technologies (AI Summary)

CVSS v4.0

9.4

Critical

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions GoCD versions prior to 24.5.0

Description The issue is related to improper authorization of access to the admin "Configuration XML" UI feature and its associated API in the GoCD system, allowing a malicious insider or existing authenticated user to escalate their privileges to that of a GoCD admin. The vulnerability can be exploited by a remote attacker, but it requires existing authentication. The estimated number of potentially affected devices is not specified.

Recommendations For GoCD versions prior to 24.5.0, upgrade to version 24.5.0 to fix the issue. As a temporary workaround, consider using a reverse proxy, WAF, or similar to externally block access paths with a /go/rails/ prefix. If it is not possible to upgrade or block the above route, consider reducing the GoCD user base to a more trusted set of users, including temporarily disabling the use of plugins such as the guest-login-plugin.

Exploit

Fix

LPE

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

BDU:2025-00427

CVE-2024-56320

GHSA-346H-Q594-RJ8J

Affected Products

Gocd

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/56xxx/CVE-2024-56320.json · Exploit
• https://github.com/gocd/gocd/security/advisories/GHSA-346h-q594-rj8j · Vendor Advisory
• https://github.com/gocd/gocd/commit/68b598b97bd283a5a85e20d018d69fe86acf4165 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-56320 · Security Note
• https://osv.dev/vulnerability/CVE-2024-56320 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-00427 · Security Note
• https://github.com/gocd/gocd/releases/tag/24.5.0 · Note
• https://t.me/cvedetector/14223 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1875273961166033375 · Twitter Post
• https://t.me/cveNotify/130608 · Telegram Post
• https://twitter.com/CVEnew/status/1875208101080465540 · Twitter Post
• https://twitter.com/CCBalert/status/1876246123142098960 · Twitter Post
• https://twitter.com/CveFindCom/status/1875210778812272837 · Twitter Post
• https://twitter.com/TweetThreatNews/status/1876310605386195131 · Twitter Post
• https://gocd.org/releases/#24-5-0 · Note