Read the docs
TI-2023-25452 Aliases CVE-2023-47112GHSA-xvmv-4rx6-x6jx

Authenticated users can view job names and groups they do not have authorization to view in Rundeck

Priority LOW 21CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-862.

Summary

Rundeck is an open source automation service with a web console, command line tools and a WebAPI. In affected versions access to two URLs used in both Rundeck Open Source and Process Automation products could allow authenticated users to access the URL path, which provides a list of job names and groups for any project, without the necessary authorization checks. The output of these endpoints only exposes the name of job groups and the jobs contained within the specified project. The output is read-only and the access does not allow changes to the information. This vulnerability has been patched in version 4.17.3. Users are advised to upgrade. Users unable to upgrade may block access to the two URLs used in either Rundeck Open Source or Process Automation products at a load balancer level.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00508 43rd percentileScored 2026-11-07
Fix Fixed rundeck (rundeck): 4.17.3org.rundeck:rundeckapp (Maven): 4.17.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
rundeckrundeck4.17.0 to before 4.17.34.17.3Patch availableCNA
—org.rundeck:rundeckapp (Maven)4.17.0 to before 4.17.34.17.3Patch availableGHSA-xvmv-4rx6-x6jx
  • rundeck Vendorrundeck Affected 4.17.0 to before 4.17.3 Fixed in 4.17.3 Patch available CNA
  • org.rundeck:rundeckapp (Maven) Vendor— Affected 4.17.0 to before 4.17.3 Fixed in 4.17.3 Patch available GHSA-xvmv-4rx6-x6jx

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:pagerduty:rundeck:*:*:*:*:*:*:*:*4.17.0 to before 4.17.3Vulnerablerundeck
  • cpe:2.3:a:pagerduty:rundeck:*:*:*:*:*:*:*:* Versions 4.17.0 to before 4.17.3 Vulnerable ·rundeck

Remediation

  • Fix · CNA rundeck (rundeck) Fixed in 4.17.3
  • Fix · GHSA-xvmv-4rx6-x6jx org.rundeck:rundeckapp (Maven) Fixed in 4.17.3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-47112
  2. 2026-10-03 Alias added: GHSA-xvmv-4rx6-x6jx

References

Advisory 2

Other 2

  • TI-2022-11729 Use of Hard-coded Cryptographic Key in rundeck/rundeck, rundeckpro/enterprise CVSS 3.1CRITICAL 9.8
  • TI-2021-16519 YAML deserialization can run untrusted code CVSS 3.1HIGH 8.8
  • TI-2022-13089 Plaintext Storage of Keys and Passwords in Rundeck and PagerDuty Process Automation CVSS 3.1HIGH 7.5
  • TI-2021-17951 Missing Authorization in Rundeck CVSS 3.1HIGH 8.1
  • TI-2023-26086 Authenticated users can view or delete jobs they do not have authorization for in Rundeck CVSS 3.1HIGH 8.1
  • TI-2019-04839 An XSS issue was discovered on the Job Edit page in Rundeck Community Edition before… CVSS 3.0MEDIUM 6.1
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences