Read the docs
TI-2022-11726 Aliases CVE-2022-29183

Reflected XSS in GoCD

Priority LOW 29CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

GoCD is a continuous delivery server. GoCD versions 20.2.0 until 21.4.0 are vulnerable to reflected cross-site scripting via abuse of the pipeline comparison function's error handling to render arbitrary HTML into the returned page. This could allow an attacker to trick a victim into executing code which would allow the attacker to operate on, or gain control over the same resources as the victim had access to. This issue is fixed in GoCD 21.4.0. As a workaround, block access to `/go/compare/.*` prior to GoCD Server via a reverse proxy, web application firewall or equivalent, which would prevent use of the pipeline comparison function.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00872 59th percentileScored 2026-11-07
Fix Fixed gocd (gocd): 21.4.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
gocdgocd20.2.0 to before 21.4.021.4.0Patch availableCNA
  • gocd Vendorgocd Affected 20.2.0 to before 21.4.0 Fixed in 21.4.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:thoughtworks:gocd:*:*:*:*:*:*:*:*20.2.0 to before 21.4.0Vulnerablegocd
  • cpe:2.3:a:thoughtworks:gocd:*:*:*:*:*:*:*:* Versions 20.2.0 to before 21.4.0 Vulnerable ·gocd

Remediation

  • Fix · CNA gocd (gocd) Fixed in 21.4.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-29183

References

Patch 1

Advisory 3

  • TI-2021-19282 An issue was discovered in ThoughtWorks GoCD before 21.3.0. CVSS 3.1HIGH 7.5
  • TI-2021-19285 An issue was discovered in ThoughtWorks GoCD before 21.3.0. CVSS 3.1CRITICAL 9.8
  • TI-2021-20193 Adding a new pipeline in GoCD server version 21.3.0 has a functionality that could be… CVSS 3.1CRITICAL 9.8
  • TI-2022-18687 Compromised agents may be able to execute remote code on GoCD Server CVSS 3.1CRITICAL 9.1
  • TI-2022-11727 Command Injection/Argument Injection in GoCD CVSS 3.1HIGH 8.8
  • TI-2024-37281 GoCD vulnerable to admin privilege escalation by a malicious internal/existing authenticated user CVSS 4.0CRITICAL 9.4
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences