Vulnerability Details : CVE-2022-36088

GoCD is a continuous delivery server. Windows installations via either the server or agent installers for GoCD prior to 22.2.0 do not adequately restrict permissions when installing outside of the default location. This could allow a malicious user with local access to the server GoCD Server or Agent are installed on to modify executables or components of the installation. This does not affect zip file-based installs, installations to other platforms, or installations inside `Program Files` or `Program Files (x86)`. This issue is fixed in GoCD 22.2.0 installers. As a workaround, if the server or agent is installed outside of `Program Files (x86)`, verify the the permission of the Server or Agent installation directory to ensure the `Everyone` user group does not have `Full Control`, `Modify` or `Write` permissions.
Published 2022-09-07 23:15:14
Updated 2022-09-16 16:42:14
Source GitHub, Inc.
View at NVD,   CVE.org
Vulnerability category: BypassGain privilege

Products affected by CVE-2022-36088

Exploit prediction scoring system (EPSS) score for CVE-2022-36088

EPSS FAQ
0.04%
Probability of exploitation activity in the next 30 days EPSS Score History
~ 6 %
Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-36088

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen
5.5
 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
1.8
3.6
 NIST
5.0
 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
1.3
3.6
 GitHub, Inc.

CWE ids for CVE-2022-36088

  • The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
    Assigned by: security-advisories@github.com (Secondary)
  • The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
    Assigned by: security-advisories@github.com (Secondary)

References for CVE-2022-36088

Jump to
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close