Authenticated users can view job names and groups they do not have authorization to view

CVE-2023-47112 → View on GitHub ↗ View on CVE.org ↗ View on NVD ↗

Description

Access to two URLs used in both Rundeck Open Source and Process Automation products could allow authenticated users to access the URL path, which provides a list of job names and groups for any project, without the necessary authorization checks.

The affected URLs are:
- http[s]://[host]/context/rdJob/*
- http[s]://[host]/context/api/*/incubator/jobs

The output of these endpoints only exposes the name of job groups and the jobs contained within the specified project. The output is read-only and the access does not allow changes to the information.

Impact

Rundeck, Process Automation version 4.17.0 up to 4.17.2

Patches

Patched versions: 4.17.3

Workarounds

Access to two URLs used in either Rundeck Open Source or Process Automation products could be blocked at a load balancer level.
- http[s]://host/context/rdJob/*
- http[s]://host/context/api/*/incubator/jobs

For more information

If you have any questions or comments about this advisory:
* Open an issue in our forums
* Enterprise Customers can open a Support ticket

Basic information

Type
reviewed
Severity
medium
Advisory on GitHub
Open advisory ↗
Repository advisory
Open repository advisory ↗
Source code
Browse source ↗
Published (advisory)
2023-11-16 20:13:06 UTC
Updated
2023-11-17 22:04:11 UTC
GitHub reviewed
2023-11-16 20:13:06 UTC
NVD published
2023-11-16

EPSS Score

Score Percentile
0.21% 43.89%

CVSS Scores

Base score Version Severity Vector
4.3 3.1 —
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Click to expand
Attack vector (AV:N)
Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:L)
Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:L)
A normal user session is enough; they don’t have to be admin.
User interaction (UI:N)
Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U)
Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:L)
Some sensitive info could get out, but not a total data dump.
Integrity (I:N)
Data isn’t meaningfully altered or forged.
Availability (A:N)
Service keeps running; no real outage angle.

Identifiers

Type Value
GHSA GHSA-xvmv-4rx6-x6jx ↗
CVE CVE-2023-47112 ↗

CWEs

CWE id Name
CWE-862 Missing Authorization

Affected packages (1)

Vulnerable version ranges and first patched releases as published by GitHub.

Ecosystem Package Vulnerable range First patched Vulnerable functions
maven org.rundeck:rundeckapp >= 4.17.0, < 4.17.3 4.17.3 —

References

cvelogic Threat Intelligence