Skip to main content

Missing Authorization

CVE-2023-48222

Medium
5.4/10

Summary

Rundeck is an open-source automation service with a web console, command line tools, and a WebAPI. In affected versions 4.12.0-rc1 through 4.17.2, access to two URLs used in both Rundeck Open Source and Process Automation products could allow authenticated users to access the URL path, which would allow access to view or delete jobs, without the necessary authorization checks. Users are advised to upgrade. There are no known workarounds for this vulnerability. This has the same fix as CVE-2023-47112.

  • LOW
  • NETWORK
  • LOW
  • UNCHANGED
  • NONE
  • LOW
  • LOW
  • NONE

CWE-862 - Missing Authorization

The missing authorization vulnerability occurs when a software program allows users to access privileged parts of the program without verifying the user credentials. Impact of such a vulnerability depends on the resources employed by the software, ranging from account takeover to sensitive information exposure, denial of service, and complete system takeover.

References

Advisory Timeline

  • Published