CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 0CVE-2022-41234
https://notcve.org/view.php?id=CVE-2022-41234
21 Sep 2022 — Jenkins Rundeck Plugin 3.6.11 and earlier does not protect access to the /plugin/rundeck/webhook/ endpoint, allowing users with Overall/Read permission to trigger jobs that are configured to be triggerable via Rundeck. Jenkins Rundeck Plugin versiones 3.6.11 y anteriores, no protegen el acceso al endpoint /plugin/rundeck/webhook/, permitiendo a usuarios con permiso Overall/Read desencadenar trabajos que están configurados para ser desencadenados por medio de Rundeck • https://www.jenkins.io/security/advisory/2022-09-21/#SECURITY-2169 • CWE-862: Missing Authorization •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2022-41233
https://notcve.org/view.php?id=CVE-2022-41233
21 Sep 2022 — Jenkins Rundeck Plugin 3.6.11 and earlier does not perform Run/Artifacts permission checks in multiple HTTP endpoints, allowing attackers with Item/Read permission to obtain information about build artifacts of a given job, if the optional Run/Artifacts permission is enabled. Jenkins Rundeck Plugin versiones 3.6.11 y anteriores, no lleva a cabo la comprobación de permisos Run/Artifacts en múltiples endpoints HTTP, permitiendo a atacantes con permiso Item/Read obtener información sobre los artefactos de cons... • https://www.jenkins.io/security/advisory/2022-09-21/#SECURITY-2170 • CWE-862: Missing Authorization •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2022-29186 – Use of Hard-coded Cryptographic Key in rundeck/rundeck, rundeckpro/enterprise
https://notcve.org/view.php?id=CVE-2022-29186
20 May 2022 — Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Rundeck community and rundeck-enterprise docker images contained a pre-generated SSH keypair. If the id_rsa.pub public key of the keypair was copied to authorized_keys files on remote host, those hosts would allow access to anyone with the exposed private credentials. This misconfiguration only impacts Rundeck Docker instances of PagerDuty® Process Automation On Prem (formerly Rundeck) version 4.0 and earlier, ... • https://github.com/rundeck/rundeck/commit/16ef7a70b202492f9fbb54d8af4bb8ea0afa10ad • CWE-321: Use of Hard-coded Cryptographic Key CWE-798: Use of Hard-coded Credentials •
CVSS: 5.4EPSS: 30%CPEs: 1EXPL: 0CVE-2022-30956
https://notcve.org/view.php?id=CVE-2022-30956
17 May 2022 — Jenkins Rundeck Plugin 3.6.10 and earlier does not restrict URL schemes in Rundeck webhook submissions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to submit crafted Rundeck webhook payloads. El plugin Jenkins Rundeck versiones 3.6.10 y anteriores, no restringe los esquemas de URL en los envíos de webhooks de Rundeck, resultando en una vulnerabilidad de tipo cross-site scripting (XSS) almacenado que puede ser explotada por atacantes capaces de enviar cargas ú... • https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2600 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 0CVE-2021-41112 – Missing Authorization in Rundeck
https://notcve.org/view.php?id=CVE-2021-41112
28 Feb 2022 — Rundeck is an open source automation service with a web console, command line tools and a WebAPI. In versions prior to 3.4.5, authenticated users could craft a request to modify or delete System or Project level Calendars, without appropriate authorization. Modifying or removing calendars could cause Scheduled Jobs to execute, or not execute on desired calendar days. Severity depends on trust level of authenticated users and impact of running or not running scheduled jobs on days governed by calendar defini... • https://github.com/rundeck/rundeck/security/advisories/GHSA-f68p-c9wh-j2q8 • CWE-862: Missing Authorization •
CVSS: 6.4EPSS: 0%CPEs: 2EXPL: 0CVE-2021-41111 – Authorization Bypass Through User-Controlled Key in Rundeck
https://notcve.org/view.php?id=CVE-2021-41111
28 Feb 2022 — Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to versions 3.4.5 and 3.3.15, an authenticated user with authorization to read webhooks in one project can craft a request to reveal Webhook definitions and tokens in another project. The user could use the revealed webhook tokens to trigger webhooks. Severity depends on trust level of authenticated users and whether any webhooks exist that trigger sensitive actions. There are patches for this vulnerabili... • https://github.com/rundeck/rundeck/commit/a3bdc06a0731da902593732022a5b9d2b4facec5 • CWE-639: Authorization Bypass Through User-Controlled Key •
CVSS: 7.2EPSS: 0%CPEs: 2EXPL: 0CVE-2021-39133 – Cross-Site Request Forgery (CSRF) can run untrusted code on Rundeck server
https://notcve.org/view.php?id=CVE-2021-39133
30 Aug 2021 — Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to version 3.3.14 and version 3.4.3, a user with `admin` access to the `system` resource type is potentially vulnerable to a CSRF attack that could cause the server to run untrusted code on all Rundeck editions. Patches are available in Rundeck versions 3.4.3 and 3.3.14. Rundeck es un servicio de automatización de código abierto con una consola web, herramientas de línea de comandos y una WebAPI. Versione... • https://github.com/rundeck/rundeck/commit/67c4eedeaf9509fc0b255aff15977a5229ef13b9 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 0CVE-2021-39132 – YAML deserialization can run untrusted code
https://notcve.org/view.php?id=CVE-2021-39132
30 Aug 2021 — Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to version 3.3.14 and version 3.4.3, an authorized user can upload a zip-format plugin with a crafted plugin.yaml, or a crafted aclpolicy yaml file, or upload an untrusted project archive with a crafted aclpolicy yaml file, that can cause the server to run untrusted code on Rundeck Community or Enterprise Edition. An authenticated user can make a POST request, that can cause the server to run untrusted co... • https://github.com/rundeck/rundeck/commit/850d12e21d22833bc148b7f458d7cb5949f829b6 • CWE-502: Deserialization of Untrusted Data •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2020-2144
https://notcve.org/view.php?id=CVE-2020-2144
09 Mar 2020 — Jenkins Rundeck Plugin 3.6.6 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. Jenkins Rundeck Plugin versiones 3.6.6 y anteriores, no configura su analizador XML para impedir ataques de tipo XML external entity (XXE). • http://www.openwall.com/lists/oss-security/2020/03/09/1 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2019-16556
https://notcve.org/view.php?id=CVE-2019-16556
17 Dec 2019 — Jenkins Rundeck Plugin 3.6.5 and earlier stores credentials unencrypted in its global configuration file and in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system. Jenkins Rundeck Plugin 3.6.5 y anteriores almacena credenciales sin cifrar en su archivo de configuración global y en archivos config.xml de trabajo en el maestro de Jenkins, donde pueden ser vistos por los usuarios con permiso de lectura extendida o acce... • http://www.openwall.com/lists/oss-security/2019/12/17/1 • CWE-522: Insufficiently Protected Credentials •