Vulnerabilities

TI-2023-25452 CVE-2023-47112 · GHSA-xvmv-4rx6-x6jx

Authenticated users can view job names and groups they do not have authorization to view in Rundeck

LOW 21

Rundeck is an open source automation service with a web console, command line tools and a WebAPI.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00508 Published 2023-11-16 Fixed in 4.17.3 CWE-862

TI-2023-26086 CVE-2023-48222 · GHSA-phmw-jx86-x666

Authenticated users can view or delete jobs they do not have authorization for in Rundeck

LOW 36

Rundeck is an open source automation service with a web console, command line tools and a WebAPI.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00449 Published 2023-11-16 Fixed in 4.17.3 CWE-862

TI-2022-13089 CVE-2022-31044 · GHSA-hprf-rrwq-jm5c

Plaintext Storage of Keys and Passwords in Rundeck and PagerDuty Process Automation

MEDIUM 40

Rundeck is an open source automation service with a web console, command line tools and a WebAPI.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00694 Published 2022-06-15 Fixed in 4.2.2, 4.3.1 CWE-256

TI-2022-11729 CVE-2022-29186

Use of Hard-coded Cryptographic Key in rundeck/rundeck, rundeckpro/enterprise

MEDIUM 51

Rundeck is an open source automation service with a web console, command line tools and a WebAPI.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01205 Published 2022-05-20 No fix listed CWE-321

TI-2021-17951 CVE-2021-41112

Missing Authorization in Rundeck

LOW 37

Rundeck is an open source automation service with a web console, command line tools and a WebAPI.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00749 Published 2022-02-28 Fixed in 3.4.5 CWE-862

TI-2021-17950 CVE-2021-41111

Authorization Bypass Through User-Controlled Key in Rundeck

LOW 29

Rundeck is an open source automation service with a web console, command line tools and a WebAPI.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00555 Published 2022-02-28 Fixed in 3.3.15, 3.4.5 CWE-639

TI-2021-16520 CVE-2021-39133 · GHSA-3jmw-c69h-426c

Cross-Site Request Forgery (CSRF) can run untrusted code on Rundeck server

LOW 32

Rundeck is an open source automation service with a web console, command line tools and a WebAPI.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00453 Published 2021-08-30 Fixed in 3.3.14, 3.4.3 CWE-352

TI-2021-16519 CVE-2021-39132 · GHSA-q4rf-3fhx-88pf

YAML deserialization can run untrusted code

MEDIUM 41

Rundeck is an open source automation service with a web console, command line tools and a WebAPI.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01688 Published 2021-08-30 Fixed in 3.3.14, 3.4.3 CWE-502

TI-2020-08883 CVE-2020-11009 · GHSA-5679-7qrc-5m7j

IDOR can reveal execution data and logs to unauthorized user in Rundeck

LOW 32

In Rundeck before version 3.2.6, authenticated users can craft a request that reveals Execution data and logs and Job details that they are not authorized to see.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01373 Published 2020-04-29 Fixed in 3.2.6 CWE-200

TI-2019-04839 CVE-2019-6804 · GHSA-4262-wr7p-gpcj

An XSS issue was discovered on the Job Edit page in Rundeck Community Edition before…

LOW 35

An XSS issue was discovered on the Job Edit page in Rundeck Community Edition before 3.0.13, related to assets/javascripts/workflowStepEditorKO.js and views/execution/_wfitemEdit.gsp.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.05315 Published 2019-01-25 Fixed in 3.0.13 CWE-79

Vulnerabilities

Filters