CVE-2022-39310

Katalog CVE

CVSS 6.5 · Medium EPSS 0,84%

Kerentanan Improper Access Control pada thoughtworks gocd. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

GoCD is a continuous delivery server. GoCD helps you automate and streamline the build-test-release cycle for continuous delivery of your product. GoCD versions prior to 21.1.0 can allow one authenticated agent to impersonate another agent, and thus receive work packages for other agents due to broken access control and incorrect validation of agent tokens within the GoCD server. Since work packages can contain sensitive information such as credentials intended only for a given job running against a specific agent environment, this can cause accidental information disclosure. Exploitation requires knowledge of agent identifiers and ability to authenticate as an existing agent with the GoCD server. This issue is fixed in GoCD version 21.1.0. There are currently no known workarounds.

Rincian

Terbit di NVD

14 Oktober 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-284: Improper Access Control

EPSS (30 hari)

0,84% peluang dieksploitasi; lebih tinggi dari 56,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.gocd.org/releases/#21-1-0 release notes · advisory vendor
• https://github.com/gocd/gocd/pull/8877 patch · advisory pihak ketiga
• https://github.com/gocd/gocd/security/advisories/GHSA-4fp5-33jh-hgcq patch · release notes · advisory pihak ketiga