Read the docs
TI-2022-08645 Aliases CVE-2022-24832

Bundled ldap-authentication-plugin fails to neutralise LDAP special elements in usernames

Priority MEDIUM 41CWE-74Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

GoCD is an open source a continuous delivery server. The bundled gocd-ldap-authentication-plugin included with the GoCD Server fails to correctly escape special characters when using the username to construct LDAP queries. While this does not directly allow arbitrary LDAP data exfiltration, it can allow an existing LDAP-authenticated GoCD user with malicious intent to construct and execute malicious queries, allowing them to deduce facts about other users or entries within the LDAP database (e.g alternate fields, usernames, hashed passwords etc) through brute force mechanisms. This only affects users who have a working LDAP authorization configuration enabled on their GoCD server, and only is exploitable by users authenticating using such an LDAP configuration. This issue has been fixed in GoCD 22.1.0, which is bundled with gocd-ldap-authentication-plugin v2.2.0-144.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01695 77th percentileScored 2026-11-07
Fix Fixed gocd (gocd): 22.1.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
gocdgocd17.5.0 to before 22.1.022.1.0Patch availableCNA
  • gocd Vendorgocd Affected 17.5.0 to before 22.1.0 Fixed in 22.1.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:thoughtworks:gocd:*:*:*:*:*:*:*:*17.5.0 to before 22.1.0Vulnerablegocd
  • cpe:2.3:a:thoughtworks:gocd:*:*:*:*:*:*:*:* Versions 17.5.0 to before 22.1.0 Vulnerable ·gocd

Remediation

  • Fix · CNA gocd (gocd) Fixed in 22.1.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-24832

References

Patch 2

Advisory 6

  • TI-2021-19282 An issue was discovered in ThoughtWorks GoCD before 21.3.0. CVSS 3.1HIGH 7.5
  • TI-2021-19285 An issue was discovered in ThoughtWorks GoCD before 21.3.0. CVSS 3.1CRITICAL 9.8
  • TI-2021-20193 Adding a new pipeline in GoCD server version 21.3.0 has a functionality that could be… CVSS 3.1CRITICAL 9.8
  • TI-2022-18687 Compromised agents may be able to execute remote code on GoCD Server CVSS 3.1CRITICAL 9.1
  • TI-2022-11727 Command Injection/Argument Injection in GoCD CVSS 3.1HIGH 8.8
  • TI-2024-37281 GoCD vulnerable to admin privilege escalation by a malicious internal/existing authenticated user CVSS 4.0CRITICAL 9.4
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences