TI-2022-16511 Aliases CVE-2022-36088

GoCD Windows installations outside default location inadequately restrict installation file permissions

LOW 24CWE-269Published 2022-09-07 · Updated 2025-04-23

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Privilege escalation, Security bypass
Confidentiality · integrity · availability: None · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-269 and CWE-284.

Summary

GoCD is a continuous delivery server. Windows installations via either the server or agent installers for GoCD prior to 22.2.0 do not adequately restrict permissions when installing outside of the default location. This could allow a malicious user with local access to the server GoCD Server or Agent are installed on to modify executables or components of the installation. This does not affect zip file-based installs, installations to other platforms, or installations inside `Program Files` or `Program Files (x86)`. This issue is fixed in GoCD 22.2.0 installers. As a workaround, if the server or agent is installed outside of `Program Files (x86)`, verify the the permission of the Server or Agent installation directory to ensure the `Everyone` user group does not have `Full Control`, `Modify` or `Write` permissions.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00231 13th percentileScored 2026-11-07

Fix Fixed gocd (gocd): 22.2.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
gocd	gocd	before 22.2.0	22.2.0	Patch available	CNA

gocd Vendorgocd Affected before 22.2.0 Fixed in 22.2.0 Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:thoughtworks:gocd::::::::	before 22.2.0	Vulnerable	gocd
cpe:2.3:o:microsoft:windows:-:::::::*	not specified by NVD	Running on	Microsoft

cpe:2.3:a:thoughtworks:gocd:*:*:*:*:*:*:*:* Versions before 22.2.0 Vulnerable ·gocd
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft

Remediation

Fix · CNA gocd (gocd) Fixed in 22.2.0

Timeline

2026-10-02 Threatist record created from CVE-2022-36088

References

Patch 1

https://github.com/gocd/gocd/commit/96add9605096ab50c5cd4c229be1d503aff506a6

Advisory 3

TI-2021-19282 An issue was discovered in ThoughtWorks GoCD before 21.3.0. CVSS 3.1HIGH 7.5
TI-2021-19285 An issue was discovered in ThoughtWorks GoCD before 21.3.0. CVSS 3.1CRITICAL 9.8
TI-2021-20193 Adding a new pipeline in GoCD server version 21.3.0 has a functionality that could be… CVSS 3.1CRITICAL 9.8
TI-2022-18687 Compromised agents may be able to execute remote code on GoCD Server CVSS 3.1CRITICAL 9.1
TI-2022-11727 Command Injection/Argument Injection in GoCD CVSS 3.1HIGH 8.8
TI-2024-37281 GoCD vulnerable to admin privilege escalation by a malicious internal/existing authenticated user CVSS 4.0CRITICAL 9.4

See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences