CVE-2022-29182

Katalog CVE

CVSS 5.4 · Medium EPSS 0,86%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada thoughtworks gocd. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

GoCD is a continuous delivery server. GoCD versions 19.11.0 through 21.4.0 (inclusive) are vulnerable to a Document Object Model (DOM)-based cross-site scripting attack via a pipeline run's Stage Details > Graphs tab. It is possible for a malicious script on a attacker-hosted site to execute script that will run within the user's browser context and GoCD session via abuse of a messaging channel used for communication between with the parent page and the stage details graph's iframe. This could allow an attacker to steal a GoCD user's session cookies and/or execute malicious code in the user's context. This issue is fixed in GoCD 22.1.0. There are currently no known workarounds.

Rincian

Terbit di NVD

20 Mei 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,86% peluang dieksploitasi; lebih tinggi dari 57,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.gocd.org/releases/#22-1-0 release notes · advisory vendor
• https://github.com/gocd/gocd/pull/10190/commits/a256d05de1445e6c77843f098581fc6a66fe4477 patch · advisory pihak ketiga
• https://github.com/gocd/gocd/releases/tag/22.1.0 release notes · advisory pihak ketiga
• https://github.com/gocd/gocd/security/advisories/GHSA-qcg6-4q44-3589 advisory pihak ketiga