CVE-2023-48222 json
Authenticated users can view or delete jobs they do not have authorization for in Rundeck
published 2023-11-16 2 y ago modified 2026-09-10 1 mo ago also GHSA-phmw-jx86-x666 , EUVD-2023-3008
- cvss
- 8.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 39%
- public exploits
- 0
- none known
Summary
Rundeck is an open source automation service with a web console, command line tools and a WebAPI. In affected versions access to two URLs used in both Rundeck Open Source and Process Automation products could allow authenticated users to access the URL path, which would allow access to view or delete jobs, without the necessary authorization checks. This issue has been addressed in version 4.17.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Patch / fix
- maven org.rundeck:rundeck 4.17.3
- pagerduty rundeck 4.17.3
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.45% chance of exploitation in the next 30 days, higher than 39% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
| NVD | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
| GitHub | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.rundeck:rundeck | >=4.12.0, <4.17.3 |
4.17.3 |
Affected products
- rundeck rundeck
Classification
- Weakness
-
- CWE-862 Missing Authorization
References
-
github.com
/rundeck/rundeck/security/advisories/GHSA-phmw-jx86-x666
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2023-48222
advisory
-
github.com
/rundeck/rundeck
package
Sources
- CVE List CVE-2023-48222
- GitHub Advisory GHSA-phmw-jx86-x666
- NVD CVE-2023-48222
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.