CVE-2023-47112: Authenticated users can view job names and groups they do not have authorization to view in Rundeck
First published: Thu Nov 16 2023(Updated: )
Access to two URLs used in both Rundeck Open Source and Process Automation products could allow authenticated users to access the URL path, which provides a list of job names and groups for any project, without the necessary authorization checks. The affected URLs are: - `http[s]://[host]/context/rdJob/*` - `http[s]://[host]/context/api/*/incubator/jobs` The output of these endpoints only exposes the name of job groups and the jobs contained within the specified project. The output is read-only and the access does not allow changes to the information. ### Impact Rundeck, Process Automation version 4.17.0 up to 4.17.2 ### Patches Patched versions: 4.17.3 ### Workarounds Access to two URLs used in either Rundeck Open Source or Process Automation products could be blocked at a load balancer level. - `http[s]://host/context/rdJob/*` - `http[s]://host/context/api/*/incubator/jobs` ### For more information If you have any questions or comments about this advisory: * Open an issue in [our forums](https://community.pagerduty.com/forum/c/process-automation) * Enterprise Customers can open a [Support ticket](https://support.rundeck.com)
Credit: security-advisories@github.com security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| maven/org.rundeck:rundeckapp | >=4.17.0<4.17.3 | 4.17.3 |
| Pagerduty Rundeck | >=4.17.0<4.17.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID is CVE-2023-47112.
What is the severity of CVE-2023-47112?
The severity of CVE-2023-47112 is medium with a value of 4.3.
How can authenticated users exploit CVE-2023-47112?
Authenticated users can exploit CVE-2023-47112 by accessing certain URLs to view job names and groups they are not authorized to view.
What is the affected software of CVE-2023-47112?
The affected software of CVE-2023-47112 is Rundeck Open Source and Process Automation products with versions between 4.17.0 and 4.17.3.
What is the remedy for CVE-2023-47112?
The remedy for CVE-2023-47112 is to upgrade to version 4.17.3 of the Rundeck software.
- collector/github-advisory-latest
- alias/GHSA-xvmv-4rx6-x6jx
- alias/CVE-2023-47112
- collector/nvd-api
- collector/nvd-cve
- collector/github-advisory
- agent/author
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- agent/weakness
- agent/severity
- agent/references
- agent/title
- agent/description
- agent/tags
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/trending
- package-manager/maven
- vendor/pagerduty
- canonical/pagerduty rundeck
- version/pagerduty rundeck/4.17.0