{"id":"CVE-2023-47112","aliases":["GHSA-xvmv-4rx6-x6jx"],"url":"https://o3.security/vulnerability/CVE-2023-47112","summary":"Authenticated users can view job names and groups they do not have authorization to view in Rundeck","details":"Access to two URLs used in both Rundeck Open Source and Process Automation products could allow authenticated users to access the URL path, which provides a list of job names and groups for any project, without the necessary authorization checks.\n\nThe affected URLs are:\n- `http[s]://[host]/context/rdJob/*` \n- `http[s]://[host]/context/api/*/incubator/jobs`\n\nThe output of these endpoints only exposes the name of job groups and the jobs contained within the specified project.  The output is read-only and the access does not allow changes to the information.\n\n### Impact\n\nRundeck, Process Automation version 4.17.0 up to 4.17.2\n\n### Patches\n\nPatched versions: 4.17.3\n\n### Workarounds\n\nAccess to two URLs used in either Rundeck Open Source or Process Automation products could be blocked at a load balancer level.\n- `http[s]://host/context/rdJob/*` \n- `http[s]://host/context/api/*/incubator/jobs`\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n* Open an issue in [our forums](https://community.pagerduty.com/forum/c/process-automation)\n* Enterprise Customers can open a [Support ticket](https://support.rundeck.com)\n\n","published":"2023-11-16T22:01:07.727Z","modified":"2026-10-28T02:31:13.560233126Z","cvss":{"score":4.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"org.rundeck:rundeckapp","fixedVersion":"4.17.3"}],"fix":{"url":"https://github.com/rundeck/rundeck/commit/8992879036a1ddacfca78559d823be0424796e7e","label":"rundeck/rundeck@8992879"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/47xxx/CVE-2023-47112.json"},{"type":"ADVISORY","url":"https://github.com/rundeck/rundeck/security/advisories/GHSA-xvmv-4rx6-x6jx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-47112"},{"type":"WEB","url":"https://github.com/rundeck/rundeck/commit/8992879036a1ddacfca78559d823be0424796e7e"},{"type":"PACKAGE","url":"https://github.com/rundeck/rundeck"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:31:13.560233126Z"}}