CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-41234
https://notcve.org/view.php?id=CVE-2022-41234
Jenkins Rundeck Plugin 3.6.11 and earlier does not protect access to the /plugin/rundeck/webhook/ endpoint, allowing users with Overall/Read permission to trigger jobs that are configured to be triggerable via Rundeck. Jenkins Rundeck Plugin versiones 3.6.11 y anteriores, no protegen el acceso al endpoint /plugin/rundeck/webhook/, permitiendo a usuarios con permiso Overall/Read desencadenar trabajos que están configurados para ser desencadenados por medio de Rundeck • https://www.jenkins.io/security/advisory/2022-09-21/#SECURITY-2169 • CWE-862: Missing Authorization •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2022-41233
https://notcve.org/view.php?id=CVE-2022-41233
Jenkins Rundeck Plugin 3.6.11 and earlier does not perform Run/Artifacts permission checks in multiple HTTP endpoints, allowing attackers with Item/Read permission to obtain information about build artifacts of a given job, if the optional Run/Artifacts permission is enabled. Jenkins Rundeck Plugin versiones 3.6.11 y anteriores, no lleva a cabo la comprobación de permisos Run/Artifacts en múltiples endpoints HTTP, permitiendo a atacantes con permiso Item/Read obtener información sobre los artefactos de construcción de un trabajo determinado, si el permiso opcional Run/Artifacts está habilitado • https://www.jenkins.io/security/advisory/2022-09-21/#SECURITY-2170 • CWE-862: Missing Authorization •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2022-29186 – Use of Hard-coded Cryptographic Key in rundeck/rundeck, rundeckpro/enterprise
https://notcve.org/view.php?id=CVE-2022-29186
Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Rundeck community and rundeck-enterprise docker images contained a pre-generated SSH keypair. If the id_rsa.pub public key of the keypair was copied to authorized_keys files on remote host, those hosts would allow access to anyone with the exposed private credentials. This misconfiguration only impacts Rundeck Docker instances of PagerDuty® Process Automation On Prem (formerly Rundeck) version 4.0 and earlier, not Debian, RPM or .WAR. Additionally, the id_rsa.pub file would have to be copied from the Docker image filesystem contents without overwriting it and used to configure SSH access on a host. • https://github.com/rundeck/rundeck/commit/16ef7a70b202492f9fbb54d8af4bb8ea0afa10ad https://github.com/rundeck/rundeck/security/advisories/GHSA-qxjx-xr2m-hgqx • CWE-321: Use of Hard-coded Cryptographic Key CWE-798: Use of Hard-coded Credentials •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2022-30956
https://notcve.org/view.php?id=CVE-2022-30956
Jenkins Rundeck Plugin 3.6.10 and earlier does not restrict URL schemes in Rundeck webhook submissions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to submit crafted Rundeck webhook payloads. El plugin Jenkins Rundeck versiones 3.6.10 y anteriores, no restringe los esquemas de URL en los envíos de webhooks de Rundeck, resultando en una vulnerabilidad de tipo cross-site scripting (XSS) almacenado que puede ser explotada por atacantes capaces de enviar cargas útiles de webhooks de Rundeck diseñadas • https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2600 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 0CVE-2021-41112 – Missing Authorization in Rundeck
https://notcve.org/view.php?id=CVE-2021-41112
Rundeck is an open source automation service with a web console, command line tools and a WebAPI. In versions prior to 3.4.5, authenticated users could craft a request to modify or delete System or Project level Calendars, without appropriate authorization. Modifying or removing calendars could cause Scheduled Jobs to execute, or not execute on desired calendar days. Severity depends on trust level of authenticated users and impact of running or not running scheduled jobs on days governed by calendar definitions. Version 3.4.5 contains a patch for this issue. • https://github.com/rundeck/rundeck/security/advisories/GHSA-f68p-c9wh-j2q8 • CWE-862: Missing Authorization •