Vulnerability in Pagerduty Rundeck
CVE-2022-31044
Rundeck is an open source automation service with a web console, command line tools and a WebAPI. The Key Storage converter plugin mechanism was not enabled correctly in Rundeck 4.2.0 and 4.2.1, resulting in use of the encryption layer for Key Storage possibly not working. Any credentials created or overwritten using Rundeck 4.2.0 or 4.2.1 might result in them being written in plaintext to the backend storage. This affects those using any `Storage Converter` plugin. Rundeck 4.3.1 and 4.2.2 have fixed the code and upon upgrade will re-encrypt any plain text values. Version 4.3.0 does not have the vulnerability, but does not include the patch to re-encrypt plain text values if 4.2.0 or 4.2.1 were used. To prevent plaintext credentials from being stored in Rundeck 4.2.0/4.2.1, write access to key storage can be disabled via ACLs. After upgrading to 4.3.1 or later, write access can be restored.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.007 (49.9th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 50th percentile — 49.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.006 · newest: 0.007 · change: +0.000
Affected products
- Pagerduty Rundeck — versions 4.2.0, 4.2.1
- Rundeck — versions >= 4.2.0, < 4.2.2
Weakness classification (CWE)
References
- github.com/rundeck/rundeck/security/advisories/GHSA-hprf-rrwq-jm5c (Third Party Advisory, Mitigation)
Frequently asked questions
- What is CVE-2022-31044?
- CVE-2022-31044 is a high-severity vulnerability in Pagerduty Rundeck, classified under Plaintext Storage of a Password. CVSS score: 7.5/10. Published 2022-06-15.
- How severe is CVE-2022-31044?
- High severity. CVSS v3 base score is 7.5 out of 10.