{"dataType": "CVE_RECORD", "dataVersion": "5.0", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2022-39311", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "dateUpdated": "2022-10-14T00:00:00", "dateReserved": "2022-09-02T00:00:00", "datePublished": "2022-10-14T00:00:00"}, "containers": {"cna": {"title": "Compromised agents may be able to execute remote code on GoCD Server", "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2022-10-14T00:00:00"}, "descriptions": [{"lang": "en", "value": "GoCD is a continuous delivery server. GoCD helps you automate and streamline the build-test-release cycle for continuous delivery of your product. GoCD versions prior to 21.1.0 are vulnerable to remote code execution on the server from a malicious or compromised agent. The Spring RemoteInvocation endpoint exposed agent communication and allowed deserialization of arbitrary java objects, as well as subsequent remote code execution. Exploitation requires agent-level authentication, thus an attacker would need to either compromise an existing agent, its network communication or register a new agent to practically exploit this vulnerability. This issue is fixed in GoCD version 21.1.0. There are currently no known workarounds."}], "affected": [{"vendor": "gocd", "product": "gocd", "versions": [{"version": "< 21.1.0", "status": "affected"}]}], "references": [{"url": "https://github.com/gocd/gocd/security/advisories/GHSA-2hjh-3p3p-8hcm"}, {"url": "https://github.com/gocd/gocd/commit/7b88b70d6f7f429562d5cab49a80ea856e34cdc8"}, {"url": "https://www.gocd.org/releases/#21-1-0"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL"}}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-502: Deserialization of Untrusted Data", "cweId": "CWE-502"}]}], "source": {"advisory": "GHSA-2hjh-3p3p-8hcm", "discovery": "UNKNOWN"}}}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:thoughtworks:gocd:*:*:*:*:*:*:*:*", "matchCriteriaId": "AE600F59-5CB0-4E7F-B58F-16121BF8F61E", "versionEndExcluding": "21.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "GoCD is a continuous delivery server. GoCD helps you automate and streamline the build-test-release cycle for continuous delivery of your product. GoCD versions prior to 21.1.0 are vulnerable to remote code execution on the server from a malicious or compromised agent. The Spring RemoteInvocation endpoint exposed agent communication and allowed deserialization of arbitrary java objects, as well as subsequent remote code execution. Exploitation requires agent-level authentication, thus an attacker would need to either compromise an existing agent, its network communication or register a new agent to practically exploit this vulnerability. This issue is fixed in GoCD version 21.1.0. There are currently no known workarounds."}, {"lang": "es", "value": "GoCD es un servidor de entrega continua. GoCD le ayuda a automatizar y agilizar el ciclo de construcci\u00f3n-prueba-lanzamiento para la entrega continua de su producto. Las versiones de GoCD anteriores a la 21.1.0 son vulnerables a la ejecuci\u00f3n remota de c\u00f3digo en el servidor desde un agente malicioso o comprometido. El endpoint de Spring RemoteInvocation expon\u00eda la comunicaci\u00f3n con el agente y permit\u00eda la deserializaci\u00f3n de objetos java arbitrarios, as\u00ed como la posterior ejecuci\u00f3n de c\u00f3digo remoto. La explotaci\u00f3n requiere autenticaci\u00f3n a nivel de agente, por lo que un atacante necesitar\u00eda comprometer un agente existente, su comunicaci\u00f3n de red o registrar un nuevo agente para explotar pr\u00e1cticamente esta vulnerabilidad. Este problema ha sido corregido en GoCD versi\u00f3n 21.1.0. Actualmente no se presentan mitigaciones conocidas"}], "id": "CVE-2022-39311", "lastModified": "2022-10-19T17:12:31.597", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2022-10-14T20:15:16.183", "references": [{"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/gocd/gocd/commit/7b88b70d6f7f429562d5cab49a80ea856e34cdc8"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Release Notes", "Third Party Advisory"], "url": "https://github.com/gocd/gocd/security/advisories/GHSA-2hjh-3p3p-8hcm"}, {"source": "security-advisories@github.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://www.gocd.org/releases/#21-1-0"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-502"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-502"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}