CVE-2021-43290

An issue was discovered in ThoughtWorks GoCD before 21.3.0. An attacker who has compromised a GoCD agent can upload a malicious file into a directory of a GoCD server. They can control the filename but the directory is placed inside of a directory that they can't control.

CVSS v3 9.8 CRITICAL
CVSS v2.0 7.5 HIGH

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://blog.sonarsource.com/gocd-vulnerability-chain	Exploit Patch Third Party Advisory
https://github.com/gocd/gocd/commit/4c4bb4780eb0d3fc4cacfc4cfcc0b07e2eaf0595	Patch Third Party Advisory
https://github.com/gocd/gocd/commit/c22e0428164af25d3e91baabd3f538a41cadc82f	Patch Third Party Advisory
https://www.gocd.org/releases/#21-3-0	Issue Tracking Release Notes Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:thoughtworks:gocd:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2022-04-14 13:15

Updated : 2024-02-28 19:09

NVD link : CVE-2021-43290

Mitre link : CVE-2021-43290

CVE.ORG link : CVE-2021-43290

JSON object : View

Products Affected

thoughtworks

gocd

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2021-43290", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2022-04-14T13:15:11.540", "references": [{"url": "https://blog.sonarsource.com/gocd-vulnerability-chain", "tags": ["Exploit", "Patch", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/gocd/gocd/commit/4c4bb4780eb0d3fc4cacfc4cfcc0b07e2eaf0595", "tags": ["Patch", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/gocd/gocd/commit/c22e0428164af25d3e91baabd3f538a41cadc82f", "tags": ["Patch", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.gocd.org/releases/#21-3-0", "tags": ["Issue Tracking", "Release Notes", "Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in ThoughtWorks GoCD before 21.3.0. An attacker who has compromised a GoCD agent can upload a malicious file into a directory of a GoCD server. They can control the filename but the directory is placed inside of a directory that they can't control."}, {"lang": "es", "value": "Se ha detectado un problema en ThoughtWorks GoCD versiones anteriores a 21.3.0. Un atacante que haya comprometido un agente GoCD puede cargar un archivo malicioso en un directorio de un servidor GoCD. Pueden controlar el nombre del archivo, pero el directorio es colocado dentro de un directorio que no pueden controlar"}], "lastModified": "2022-04-26T17:13:18.550", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:thoughtworks:gocd:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "96C28DAA-9A8B-46E3-9443-656B378A26D8", "versionEndExcluding": "21.3.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}