| Package | Affected versions | Patched versions |
|---|---|---|
| org.rundeck:rundeckapp | ≥ 4.17.0, < 4.17.3 | 4.17.3 |
| rundeck | ≥ 4.17.0, < 4.17.3 | 4.17.3 |
Access to two URLs used in both Rundeck Open Source and Process Automation products could allow authenticated users to access the URL path, which provides a list of job names and groups for any project, without the necessary authorization checks.
The affected URLs are:
http[s]://[host]/context/rdJob/*http[s]://[host]/context/api/*/incubator/jobsThe output of these endpoints only exposes the name of job groups and the jobs contained within the specified project. The output is read-only and the access does not allow changes to the information.
Rundeck, Process Automation version 4.17.0 up to 4.17.2
Patched versions: 4.17.3
Access to two URLs used in either Rundeck Open Source or Process Automation products could be blocked at a load balancer level.
http[s]://host/context/rdJob/*http[s]://host/context/api/*/incubator/jobsIf you have any questions or comments about this advisory:
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free