CVE-2023-48222: pagerduty rundeck

csirt@kutim:~/threat-intel/cve/CVE-2023-48222

CVSS 5.4 · Medium EPSS 0,45%

Kerentanan Missing Authorization pada pagerduty rundeck. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

Rundeck is an open source automation service with a web console, command line tools and a WebAPI. In affected versions access to two URLs used in both Rundeck Open Source and Process Automation products could allow authenticated users to access the URL path, which would allow access to view or delete jobs, without the necessary authorization checks. This issue has been addressed in version 4.17.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Rincian

Terbit di NVD: 16 November 2023
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-862: Missing Authorization
EPSS (30 hari): 0,45% peluang dieksploitasi; lebih tinggi dari 37,2% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
pagerduty	rundeck	Versi 4.12.0 hingga sebelum 4.17.3

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/rundeck/rundeck/security/advisories/GHSA-phmw-jx86-x666 advisory vendor

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.