Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2020-11009— IDOR can reveal execution data and logs to unauthorized user in Rundeck

Quick assessment

Affected
rundeck rundeck
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Rundeck是美国Rundeck公司的一款带有Web控制台、命令行工具和WebAPI的开源自动化服务，它主要用于运行自动化任务。 Rundeck 3.2.6之前版本中存在信息泄露漏洞。攻击者可通过发送请求利用该漏洞获取Execution数据、日志及Job详情。

CVSS 6.5 · Medium EPSS 1.37% · P69

Possible ATT&CK Techniques 1 AI

T1530 · Data from Cloud Storage
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2020-11009

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
IDOR can reveal execution data and logs to unauthorized user in Rundeck
Source: CVE Program / CVE List V5
Vulnerability Description
In Rundeck before version 3.2.6, authenticated users can craft a request that reveals Execution data and logs and Job details that they are not authorized to see. Depending on the configuration and the way that Rundeck is used, this could result in anything between a high severity risk, or a very low risk. If access is tightly restricted and all users on the system have access to all projects, this is not really much of an issue. If access is wider and allows login for users that do not have access to any projects, or project access is restricted, there is a larger issue. If access is meant to be restricted and secrets, sensitive data, or intellectual property are exposed in Rundeck execution output and job data, the risk becomes much higher. This vulnerability is patched in version 3.2.6
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5
Vulnerability Title
Rundeck 信息泄露漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Rundeck是美国Rundeck公司的一款带有Web控制台、命令行工具和WebAPI的开源自动化服务，它主要用于运行自动化任务。 Rundeck 3.2.6之前版本中存在信息泄露漏洞。攻击者可通过发送请求利用该漏洞获取Execution数据、日志及Job详情。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
rundeck rundeck < 3.2.6 -

II. Public POCs for CVE-2020-11009

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2020-11009

请登录查看更多情报信息。

Vendor Advisories for CVE-2020-11009 (1)

Other References for CVE-2020-11009 (1)

IV. Related Vulnerabilities

Same product: rundeck
Same vendor: rundeck
Same weakness: CWE-200

V. Comments for CVE-2020-11009

No comments yet

Leave a comment