Vendor
rundeck
12 known vulnerabilities.
Products
4 results · Clear filters · Feed
-
Medium 6.5
Rundeck before 6.2.0 Arbitrary File Read via File Resource Model Source
Rundeck before 6.2.0 contains a path traversal vulnerability that allows users holding only the project configure ACL to read arbitrary server files by setting resources.source.N.config.file to any absolute path. Attackers can retrieve file contents through e…
-
Medium 4.3
Authenticated users can view job names and groups they do not have authorization to view in Rundeck
Rundeck is an open source automation service with a web console, command line tools and a WebAPI. In affected versions access to two URLs used in both Rundeck Open Source and Process Automation products could allow authenticated users to access the URL path, …
-
Medium 6.4
Authorization Bypass Through User-Controlled Key in Rundeck
Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to versions 3.4.5 and 3.3.15, an authenticated user with authorization to read webhooks in one project can craft a request to reveal Webhook definitions an…
-
Medium 6.5
IDOR can reveal execution data and logs to unauthorized user in Rundeck
In Rundeck before version 3.2.6, authenticated users can craft a request that reveals Execution data and logs and Job details that they are not authorized to see. Depending on the configuration and the way that Rundeck is used, this could result in anything b…