CVE-2022-24832 Bundled ldap-authentication-plugin fails to neutralise LDAP special elements in usernames

GoCD is an open source a continuous delivery server. The bundled gocd-ldap-authentication-plugin included with the GoCD Server fails to correctly escape special characters when using the username to construct LDAP queries. While this does not directly allow arbitrary LDAP data exfiltration, it ca...

CVE-2022-24832

The CVE-2022-24832 issue affects GoCD where the bundled gocd-ldap-authentication-plugin does not properly escape special characters in LDAP usernames when constructing LDAP queries. This can enable an LDAP-authenticated GoCD user to craft and execute malicious queries to infer facts about other L...

CVE-2022-24832 Bundled ldap-authentication-plugin fails to neutralise LDAP special elements in usernames

GoCD is an open source a continuous delivery server. The bundled gocd-ldap-authentication-plugin included with the GoCD Server fails to correctly escape special characters when using the username to construct LDAP queries. While this does not directly allow arbitrary LDAP data exfiltration, it ca...

GoCD 注入漏洞

GoCd is a continuous delivery server. GoCD suffers from an injection vulnerability that stems from the fact that the gocd-ldap-authentication-plugin included in GoCD Server fails to properly escape special characters when constructing an LDAP query using a username. An attacker could use this...

ThoughtWorks GoCD Web interface detection

Binary data gocdwebdetect.nbin...

GoCD < 21.3.0 Path Traversal (Direct)

Binary data gocdpathtraversal.nbin...

ThoughtWorks GoCD Default Administrator Access

Binary data gocddefaultaccess.nbin...

GoCD < 21.3.0 Path Traversal

The GoCD web application running on the remote host has the Business Continuity add-on enabled by default. It is, therefore, affected by a directory traversal vulnerability due to an improper access restriction. An unauthenticated, remote attacker can exploit this, by sending a URI that contains...

gocd request forgery vulnerability

gocd is a continuous delivery server. gocd has a server-side request forgery vulnerability in version 21.3.0, which stems from the product's failure to properly validate user input and could be exploited to probe the server's intranet resources...

CVE-2021-44659

Adding a new pipeline in GoCD server version 21.3.0 has a functionality that could be abused to do an un-intended action in order to achieve a Server Side Request Forgery SSRF. NOTE: the vendor's position is that the observed behavior is not a vulnerability, because the product's design allows an...

CVE-2021-44659

Adding a new pipeline in GoCD server version 21.3.0 has a functionality that could be abused to do an un-intended action in order to achieve a Server Side Request Forgery SSRF. NOTE: the vendor's position is that the observed behavior is not a vulnerability, because the product's design allows an...

Server side request forgery (ssrf)

DISPUTED Adding a new pipeline in GoCD server version 21.3.0 has a functionality that could be abused to do an un-intended action in order to achieve a Server Side Request Forgery SSRF. NOTE: the vendor's position is that the observed behavior is not a vulnerability, because the product's design...

CVE-2021-44659

GoCD server version 21.3.0 contains a possible Server Side Request Forgery (SSRF) when adding a new pipeline. The issue stems from how outbound requests are handled/validated, with multiple connected sources attributing the vulnerability to inadequate input validation and configuration of outboun...

CVE-2021-44659

Adding a new pipeline in GoCD server version 21.3.0 has a functionality that could be abused to do an un-intended action in order to achieve a Server Side Request Forgery SSRF. NOTE: the vendor's position is that the observed behavior is not a vulnerability, because the product's design allows an...

GoCD 代码问题漏洞

gocd is a continuous delivery server. gocd has a server-side request forgery vulnerability in version 21.3.0, which stems from the product's failure to properly validate user input and could be exploited to probe the server's intranet resources...

CVE-2021-43287 Allows Pre-Authenticated Build Takeover of GoCD Pipelines

On October 26, 2021, open-source CI/CD solution GoCD released version 21.3.0, which included a fix for CVE-2021-43287, a critical information disclosure vulnerability whose exploitation allows unauthenticated attackers to leak configuration information, including build secrets and encryption keys...

Pre-Auth Takeover of Build Pipelines in GoCD (CVE-2021-43287)

Please see https://blog.sonarsource.com/gocd-pre-auth-pipeline-takeover. Rapid7 Analysis Description On October 27, 2021, SonarSource published a blog post describing a pre-authenticated information disclosure vulnerability in GoCD, an open-source CI/CD server. This vulnerability is now known as...

GoCD Authentication Vulnerability

GoCD has released a security update to address a critical authentication vulnerability in GoCD versions 20.6.0 through 21.2.0. GoCD is an open-source Continuous Integration and Continuous Delivery system. A remote attacker could exploit this vulnerability to obtain sensitive information. CISA...

CVE-2021-25924

In GoCD, versions 19.6.0 to 21.1.0 are vulnerable to Cross-Site Request Forgery due to missing CSRF protection at the /go/api/config/backup endpoint. An attacker can trick a victim to click on a malicious link which could change backup configurations or execute system commands in the...

CVE-2021-25924

In GoCD, versions 19.6.0 to 21.1.0 are vulnerable to Cross-Site Request Forgery due to missing CSRF protection at the /go/api/config/backup endpoint. An attacker can trick a victim to click on a malicious link which could change backup configurations or execute system commands in the...