Read the docs
TI-2024-37283 Aliases CVE-2024-56322

GoCD vulnerable to XXE injection via abuse of unused XML configuration repository functionality

Priority LOW 12CWE-611Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
High
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

GoCD is a continuous deliver server. GoCD versions 16.7.0 through 24.4.0 (inclusive) can allow GoCD admins to abuse a hidden/unused configuration repository (pipelines as code) feature to allow XML External Entity (XXE) injection on the GoCD Server which will be executed when GoCD periodically scans configuration repositories for pipeline updates, or is triggered by an administrator or config repo admin. In practice the impact of this vulnerability is limited, in most cases without combining with another vulnerability, as only GoCD (super) admins have the ability to abuse this vulnerability. Typically a malicious GoCD admin can cause much larger damage than that they can do with XXE injection. The issue is fixed in GoCD 24.5.0. As a workaround, prevent external access from the GoCD server to arbitrary locations using some kind of environment egress control.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00723 54th percentileScored 2026-11-07
Fix Fixed gocd (gocd): 24.5.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
gocdgocd16.7.0 to before 24.5.024.5.0Patch availableCNA
  • gocd Vendorgocd Affected 16.7.0 to before 24.5.0 Fixed in 24.5.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:thoughtworks:gocd:*:*:*:*:*:*:*:*16.7.0 to before 24.5.0Vulnerablegocd
  • cpe:2.3:a:thoughtworks:gocd:*:*:*:*:*:*:*:* Versions 16.7.0 to before 24.5.0 Vulnerable ·gocd

Remediation

  • Fix · CNA gocd (gocd) Fixed in 24.5.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-56322

References

Patch 1

Advisory 1

Other 2

  • TI-2021-19282 An issue was discovered in ThoughtWorks GoCD before 21.3.0. CVSS 3.1HIGH 7.5
  • TI-2021-19285 An issue was discovered in ThoughtWorks GoCD before 21.3.0. CVSS 3.1CRITICAL 9.8
  • TI-2021-20193 Adding a new pipeline in GoCD server version 21.3.0 has a functionality that could be… CVSS 3.1CRITICAL 9.8
  • TI-2022-18687 Compromised agents may be able to execute remote code on GoCD Server CVSS 3.1CRITICAL 9.1
  • TI-2022-11727 Command Injection/Argument Injection in GoCD CVSS 3.1HIGH 8.8
  • TI-2024-37281 GoCD vulnerable to admin privilege escalation by a malicious internal/existing authenticated user CVSS 4.0CRITICAL 9.4
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences