CVE-2023-48222

HIGH

Rundeck 4.12.0-4.17.2 - Authenticated Missing Authorization for Job Access

Title source: llm
STIX 2.1

Description

Rundeck is an open source automation service with a web console, command line tools and a WebAPI. In affected versions access to two URLs used in both Rundeck Open Source and Process Automation products could allow authenticated users to access the URL path, which would allow access to view or delete jobs, without the necessary authorization checks. This issue has been addressed in version 4.17.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.

References (1)

Core 1
Core References

Scores

CVSS v3 8.1
EPSS 0.0045
EPSS Percentile 36.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-862
Status published
Products (2)
org.rundeck/rundeck 4.12.0 - 4.17.3Maven
pagerduty/rundeck 4.12.0 - 4.17.3
Published Nov 16, 2023
Tracked Since Feb 18, 2026