{"id":"GHSA-xvmv-4rx6-x6jx","summary":"Authenticated users can view job names and groups they do not have authorization to view","details":"Access to two URLs used in both Rundeck Open Source and Process Automation products could allow authenticated users to access the URL path, which provides a list of job names and groups for any project, without the necessary authorization checks.\n\nThe affected URLs are:\n- `http[s]://[host]/context/rdJob/*` \n- `http[s]://[host]/context/api/*/incubator/jobs`\n\nThe output of these endpoints only exposes the name of job groups and the jobs contained within the specified project.  The output is read-only and the access does not allow changes to the information.\n\n### Impact\n\nRundeck, Process Automation version 4.17.0 up to 4.17.2\n\n### Patches\n\nPatched versions: 4.17.3\n\n### Workarounds\n\nAccess to two URLs used in either Rundeck Open Source or Process Automation products could be blocked at a load balancer level.\n- `http[s]://host/context/rdJob/*` \n- `http[s]://host/context/api/*/incubator/jobs`\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n* Open an issue in [our forums](https://community.pagerduty.com/forum/c/process-automation)\n* Enterprise Customers can open a [Support ticket](https://support.rundeck.com)\n\n","aliases":["CVE-2023-47112"],"modified":"2023-11-17T22:04:11Z","published":"2023-11-16T20:13:06Z","database_specific":{"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2023-11-16T20:13:06Z","nvd_published_at":"2023-11-16T22:15:28Z","cwe_ids":["CWE-862"]},"references":[{"type":"WEB","url":"https://github.com/rundeck/rundeck/security/advisories/GHSA-xvmv-4rx6-x6jx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-47112"},{"type":"WEB","url":"https://github.com/rundeck/rundeck/commit/8992879036a1ddacfca78559d823be0424796e7e"},{"type":"PACKAGE","url":"https://github.com/rundeck/rundeck"}],"affected":[{"package":{"name":"org.rundeck:rundeckapp","ecosystem":"Maven","purl":"pkg:maven/org.rundeck/rundeckapp"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.17.0"},{"fixed":"4.17.3"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/11/GHSA-xvmv-4rx6-x6jx/GHSA-xvmv-4rx6-x6jx.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"}]}