What is CVE-2023-48222?

CVE-2023-48222 is a high-severity vulnerability in Pagerduty Rundeck, classified under Missing Authorization. CVSS score: 8.1/10. Published 2023-11-16.

How severe is CVE-2023-48222?

High severity. CVSS v3 base score is 8.1 out of 10.

Auth bypass in Pagerduty Rundeck

CVE-2023-48222

Rundeck is an open source automation service with a web console, command line tools and a WebAPI. In affected versions access to two URLs used in both Rundeck Open Source and Process Automation products could allow authenticated users to access the URL path, which would allow access to view or delete jobs, without the necessary authorization checks. This issue has been addressed in version 4.17.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Vulnerability class: Broken Access Control

EPSS: 0.004 (36.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N.

Affected products

Pagerduty Rundeck
Rundeck — versions >= 4.12.0, < 4.17.3

Weakness classification (CWE)

CWE-862 — Missing Authorization

References

security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2023-48222?: CVE-2023-48222 is a high-severity vulnerability in Pagerduty Rundeck, classified under Missing Authorization. CVSS score: 8.1/10. Published 2023-11-16.
How severe is CVE-2023-48222?: High severity. CVSS v3 base score is 8.1 out of 10.