Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

org.rundeck:rundeckapp

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 4.3MavenPublished

    Authenticated users can view job names and groups they do not have authorization to view

    CVE-2023-47112 · GHSA-xvmv-4rx6-x6jx

    Affected
    • Maven org.rundeck:rundeckapp >= 4.17.0, < 4.17.3
    Fixed in
    4.17.3· Vendor fix available
    Issue
    Access to two URLs used in both Rundeck Open Source and Process Automation products could allow authenticated users to access the URL path, which provides a list of job names and groups for any project, without the necessary authorization checks. The affected URLs are: - http[s]://[host]/context/rdJob/ - http[s]://[host]/context/api//incubator/jobs The output of these endpoints only exposes the name of job groups and the jobs contained within the specified project. The output is read-only and the access does not allow changes to the information. Impact Rundeck, Process Automation version 4.17.0 up to 4.17.2 Patches Patched versions: 4.17.3 Workarounds Access to two URLs used in either Rundeck Open Source or Process Automation products could be blocked at a load balancer level. - http[s]://host/context/rdJob/ - http[s]://host/context/api//incubator/jobs For more information If you have any questions or comments about this advisory: Open an issue in our forums Enterprise Customers can…

    Recommended action: Upgrade to 4.17.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →