CVE-2022-39309

Katalog CVE

CVSS 6.5 · Medium EPSS 1,0%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada thoughtworks gocd. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

GoCD is a continuous delivery server. GoCD helps you automate and streamline the build-test-release cycle for continuous delivery of your product. GoCD versions prior to 21.1.0 leak the symmetric key used to encrypt/decrypt any secure variables/secrets in GoCD configuration to authenticated agents. A malicious/compromised agent may then expose that key from memory, and potentially allow an attacker the ability to decrypt secrets intended for other agents/environments if they also are able to obtain access to encrypted configuration values from the GoCD server. This issue is fixed in GoCD version 21.1.0. There are currently no known workarounds.

Rincian

Terbit di NVD

14 Oktober 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-499: Serializable Class Containing Sensitive Data
CWE-668: Exposure of Resource to Wrong Sphere

EPSS (30 hari)

1,0% peluang dieksploitasi; lebih tinggi dari 63,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.gocd.org/releases/#21-1-0 release notes · advisory vendor
• https://github.com/gocd/gocd/commit/691b479f1310034992da141760e9c5d1f5b60e8a patch · advisory pihak ketiga
• https://github.com/gocd/gocd/security/advisories/GHSA-f9qg-xcxq-cgv9 patch · release notes · advisory pihak ketiga
• https://github.com/gocd/gocd/releases/tag/21.1.0 release notes · advisory pihak ketiga