CVE-2021-43287

Опубликовано: 14 апр. 2022

Источник: nvd

CVSS3: 7.5

CVSS2: 5

EPSS Критический

Описание

An issue was discovered in ThoughtWorks GoCD before 21.3.0. The business continuity add-on, which is enabled by default, leaks all secrets known to the GoCD server to unauthenticated attackers.

Ссылки

https://blog.sonarsource.com/gocd-pre-auth-pipeline-takeover
Exploit
Patch
Third Party Advisory
https://github.com/gocd/gocd/commit/41abc210ac4e8cfa184483c9ff1c0cc04fb3511c
Patch
Third Party Advisory
https://www.gocd.org/releases/#21-3-0
Issue Tracking
Release Notes
Vendor Advisory
https://blog.sonarsource.com/gocd-pre-auth-pipeline-takeover
Exploit
Patch
Third Party Advisory
https://github.com/gocd/gocd/commit/41abc210ac4e8cfa184483c9ff1c0cc04fb3511c
Patch
Third Party Advisory
https://www.gocd.org/releases/#21-3-0
Issue Tracking
Release Notes
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:thoughtworks:gocd:*:*:*:*:*:*:*:*

Версия до 21.3.0 (исключая)

EPSS

Процентиль: 100%

0.91307

Критический

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-200

Связанные уязвимости

GHSA-4x25-wq2v-85f9