CVE-2021-43288

An issue was discovered in ThoughtWorks GoCD before 21.3.0. An attacker in control of a GoCD Agent can plant malicious JavaScript into a failed Job Report...

CVE-2021-43288

An issue was discovered in ThoughtWorks GoCD before 21.3.0. An attacker in control of a GoCD Agent can plant malicious JavaScript into a failed Job Report...

CVE-2021-43289

An issue was discovered in ThoughtWorks GoCD before 21.3.0. An attacker who has compromised a GoCD agent can upload a malicious file into an arbitrary directory of a GoCD server, but does not control the filename...

CVE-2021-43289

An issue was discovered in ThoughtWorks GoCD before 21.3.0. An attacker who has compromised a GoCD agent can upload a malicious file into an arbitrary directory of a GoCD server, but does not control the filename...

CVE-2021-43290

An issue was discovered in ThoughtWorks GoCD before 21.3.0. An attacker who has compromised a GoCD agent can upload a malicious file into a directory of a GoCD server. They can control the filename but the directory is placed inside of a directory that they can't control...

CVE-2021-43290

An issue was discovered in ThoughtWorks GoCD before 21.3.0. An attacker who has compromised a GoCD agent can upload a malicious file into a directory of a GoCD server. They can control the filename but the directory is placed inside of a directory that they can't control...

Design/Logic Flaw

An issue was discovered in ThoughtWorks GoCD before 21.3.0. The business continuity add-on, which is enabled by default, leaks all secrets known to the GoCD server to unauthenticated attackers...

CVE-2021-43287

An issue was discovered in ThoughtWorks GoCD before 21.3.0. The business continuity add-on, which is enabled by default, leaks all secrets known to the GoCD server to unauthenticated attackers...

CVE-2021-43287

An issue was discovered in ThoughtWorks GoCD before 21.3.0. The business continuity add-on, which is enabled by default, leaks all secrets known to the GoCD server to unauthenticated attackers...

CVE-2021-43287

CVE-2021-43287 affects ThoughtWorks GoCD prior to 21.3.0. The vulnerability is an information-disclosure flaw in the default-enabled business-continuity add-on, allowing unauthenticated attackers to leak all secrets known to the GoCD server (e.g., build secrets, encryption keys). The linked sourc...

ThoughtWorks GoCD 跨站脚本漏洞

ThoughtWorks GoCD is a free and open source CI/CD server from ThoughtWorks, Inc. A cross-site scripting vulnerability exists in versions of ThoughtWorks GoCD prior to 21.3.0, which can be exploited by an attacker controlling a GoCD agent to plant malicious JavaScript into a failed job report...

ThoughtWorks GoCD 路径遍历漏洞

ThoughtWorks GoCD is a free and open source CI/CD server from ThoughtWorks USA. A security vulnerability exists in ThoughtWorks GoCD versions prior to 21.3.0, which can be exploited by an attacker who compromises the GoCD agent to upload malicious files to a directory on the GoCD server...

CVE-2021-43288: Improper Neutralization of Input During Web Page Generation

An issue was discovered in ThoughtWorks GoCD before 21.3.0. An attacker in control of a GoCD Agent can plant malicious JavaScript into a failed Job Report...

CVE-2021-43290: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in ThoughtWorks GoCD before 21.3.0. An attacker who has compromised a GoCD agent can upload a malicious file into a directory of a GoCD server. They can control the filename but the directory is placed inside of a directory that they can't control...

CVE-2021-43287: Exposure of Sensitive Information to an Unauthorized Actor

An issue was discovered in ThoughtWorks GoCD before 21.3.0. The business continuity add-on, which is enabled by default, leaks all secrets known to the GoCD server to unauthenticated attackers...

PT-2022-11811

Name of the Vulnerable Software and Affected Versions ThoughtWorks GoCD versions prior to 21.3.0 Description An issue was discovered in ThoughtWorks GoCD where an attacker with privileges to create a new pipeline on a GoCD server can abuse a command-line injection in the Git URL "Test Connection"...

PT-2022-11813

Name of the Vulnerable Software and Affected Versions ThoughtWorks GoCD versions prior to 21.3.0 Description An issue was discovered where an attacker in control of a GoCD Agent can plant malicious JavaScript into a failed Job Report. Recommendations For versions prior to 21.3.0, update to versio...

PT-2022-11815

Name of the Vulnerable Software and Affected Versions ThoughtWorks GoCD versions prior to 21.3.0 Description An issue was discovered in ThoughtWorks GoCD where an attacker who has compromised a GoCD agent can upload a malicious file into a directory of a GoCD server. The attacker can control the...

PT-2022-11812

Name of the Vulnerable Software and Affected Versions ThoughtWorks GoCD versions prior to 21.3.0 Description An issue was discovered in ThoughtWorks GoCD where the business continuity add-on, which is enabled by default, leaks all secrets known to the GoCD server to unauthenticated attackers...

PT-2022-11814

Name of the Vulnerable Software and Affected Versions ThoughtWorks GoCD versions prior to 21.3.0 Description An issue allows an attacker who has compromised a GoCD agent to upload a malicious file into an arbitrary directory of a GoCD server. However, the attacker does not control the filename...