From 7df0009dc63296059845d12e71dbdec86f015452 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Thu, 16 Nov 2023 20:14:28 +0000
Subject: [PATCH] Publish GHSA-xvmv-4rx6-x6jx

---
 .../GHSA-xvmv-4rx6-x6jx.json                  | 61 +++++++++++++++++++
 1 file changed, 61 insertions(+)
 create mode 100644 advisories/github-reviewed/2023/11/GHSA-xvmv-4rx6-x6jx/GHSA-xvmv-4rx6-x6jx.json

diff --git a/advisories/github-reviewed/2023/11/GHSA-xvmv-4rx6-x6jx/GHSA-xvmv-4rx6-x6jx.json b/advisories/github-reviewed/2023/11/GHSA-xvmv-4rx6-x6jx/GHSA-xvmv-4rx6-x6jx.json
new file mode 100644
index 00000000000..8d0a774f5a9
--- /dev/null
+++ b/advisories/github-reviewed/2023/11/GHSA-xvmv-4rx6-x6jx/GHSA-xvmv-4rx6-x6jx.json
@@ -0,0 +1,61 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-xvmv-4rx6-x6jx",
+  "modified": "2023-11-16T20:13:06Z",
+  "published": "2023-11-16T20:13:06Z",
+  "aliases": [
+    "CVE-2023-47112"
+  ],
+  "summary": "Authenticated users can view job names and groups they do not have authorization to view",
+  "details": "Access to two URLs used in both Rundeck Open Source and Process Automation products could allow authenticated users to access the URL path, which provides a list of job names and groups for any project, without the necessary authorization checks.\n\nThe affected URLs are:\n- `http[s]://[host]/context/rdJob/*` \n- `http[s]://[host]/context/api/*/incubator/jobs`\n\nThe output of these endpoints only exposes the name of job groups and the jobs contained within the specified project.  The output is read-only and the access does not allow changes to the information.\n\n### Impact\n\nRundeck, Process Automation version 4.17.0 up to 4.17.2\n\n### Patches\n\nPatched versions: 4.17.3\n\n### Workarounds\n\nAccess to two URLs used in either Rundeck Open Source or Process Automation products could be blocked at a load balancer level.\n- `http[s]://host/context/rdJob/*` \n- `http[s]://host/context/api/*/incubator/jobs`\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n* Open an issue in [our forums](https://community.pagerduty.com/forum/c/process-automation)\n* Enterprise Customers can open a [Support ticket](https://support.rundeck.com)\n\n",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.rundeck:rundeckapp"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "4.17.0"
+            },
+            {
+              "fixed": "4.17.3"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/rundeck/rundeck/security/advisories/GHSA-xvmv-4rx6-x6jx"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/rundeck/rundeck/commit/8992879036a1ddacfca78559d823be0424796e7e"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/rundeck/rundeck"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2023-11-16T20:13:06Z",
+    "nvd_published_at": null
+  }
+}
\ No newline at end of file