Publish GHSA-xvmv-4rx6-x6jx

2026-05-22 18:04:22 -07:00 · 2023-11-16 20:14:28 +00:00
parent cb437c42d3
commit 7df0009dc6
1 changed files with 61 additions and 0 deletions
@@ -0,0 +1,61 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-xvmv-4rx6-x6jx",
+  "modified": "2023-11-16T20:13:06Z",
+  "published": "2023-11-16T20:13:06Z",
+  "aliases": [
+    "CVE-2023-47112"
+  ],
+  "summary": "Authenticated users can view job names and groups they do not have authorization to view",
+  "details": "Access to two URLs used in both Rundeck Open Source and Process Automation products could allow authenticated users to access the URL path, which provides a list of job names and groups for any project, without the necessary authorization checks.\n\nThe affected URLs are:\n- `http[s]://[host]/context/rdJob/*` \n- `http[s]://[host]/context/api/*/incubator/jobs`\n\nThe output of these endpoints only exposes the name of job groups and the jobs contained within the specified project.  The output is read-only and the access does not allow changes to the information.\n\n### Impact\n\nRundeck, Process Automation version 4.17.0 up to 4.17.2\n\n### Patches\n\nPatched versions: 4.17.3\n\n### Workarounds\n\nAccess to two URLs used in either Rundeck Open Source or Process Automation products could be blocked at a load balancer level.\n- `http[s]://host/context/rdJob/*` \n- `http[s]://host/context/api/*/incubator/jobs`\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n* Open an issue in [our forums](https://community.pagerduty.com/forum/c/process-automation)\n* Enterprise Customers can open a [Support ticket](https://support.rundeck.com)\n\n",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.rundeck:rundeckapp"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "4.17.0"
+            },
+            {
+              "fixed": "4.17.3"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/rundeck/rundeck/security/advisories/GHSA-xvmv-4rx6-x6jx"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/rundeck/rundeck/commit/8992879036a1ddacfca78559d823be0424796e7e"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/rundeck/rundeck"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2023-11-16T20:13:06Z",
+    "nvd_published_at": null
+  }
+}