CVE-2023-48222 - CVE House

Back to Database

Status published High CVE-2023-48222

Authenticated users can view or delete jobs they do not have authorization for in Rundeck

8.1 CVSS

Vulnerability Description

Rundeck is an open source automation service with a web console, command line tools and a WebAPI. In affected versions access to two URLs used in both Rundeck Open Source and Process Automation products could allow authenticated users to access the URL path, which would allow access to view or delete jobs, without the necessary authorization checks. This issue has been addressed in version 4.17.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-48222

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

https://github.com/rundeck/rundeck/security/advisories/GHSA-phmw-jx86-x666

More from rundeck

View All →

Authenticated users can view job names and groups they do not have authorization to view in Rundeck

Plaintext Storage of Keys and Passwords in Rundeck and PagerDuty Process Automation

Use of Hard-coded Cryptographic Key in rundeck/rundeck, rundeckpro/enterprise

Missing Authorization in Rundeck

Authorization Bypass Through User-Controlled Key in Rundeck

Affected Vendor

rundeck

View all reports →

Affected Software

rundeck

Vulnerable Versions:

>= 4.12.0, < 4.17.3

Timeline

Official Publish: November 16th, 2023

Last Modified: August 29th, 2024

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1078 Valid Accounts

T1531 Account Access Removal