CVE-2022-39309: falha de média gravidade em gocd
GoCD server secret encryption/decryption key leaked to agents during material serialization
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 4.9epss 1.1%
GoCD is a continuous delivery server. GoCD helps you automate and streamline the build-test-release cycle for continuous delivery of your product. GoCD versions prior to 21.1.0 leak the symmetric key used to encrypt/decrypt any secure variables/secrets in GoCD configuration to authenticated agents. A malicious/compromised agent may then expose that key from memory, and potentially allow an attacker the ability to decrypt secrets intended for other agents/environments if they also are able to obtain access to encrypted configuration values from the GoCD server. This issue is fixed in GoCD version 21.1.0. There are currently no known workarounds.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
gocd · gocdCVEs relacionadas — gocd
No mesmo produto, das mais perigosas para as menos.
CVE-2022-29184HIGHCommand Injection/Argument Injection in GoCDEPSS 3.6%CVE-2022-39311CRITICALCompromised agents may be able to execute remote code on GoCD ServerEPSS 2.2%CVE-2022-24832HIGHBundled ldap-authentication-plugin fails to neutralise LDAP special elements in usernamesEPSS 1.7%CVE-2022-29183MEDIUMReflected XSS in GoCDEPSS 0.9%CVE-2022-39308MEDIUMGoCD API authentication of user access tokens subject to timing attack during comparisonEPSS 0.9%CVE-2022-39310MEDIUMMalicious agent may be able to impersonate another agent in GoCDEPSS 0.9%