Rundeck 4.17.4 vulnerabilities
Rundeck 4.17.4 has 3 known vulnerabilities (2 high). Each one is ranked by real-world exploitation and severity, with the version that fixes it where one is known. Free, no account.
Cross-referencing the vulnerability databases…
Rundeck 4.17.4
Rundeck through 6.2.1 fails to properly authorize the importConfig and importNodesSources parameters in the project archive import endpoint. Attackers with only the import action can replace project configuration files including security-relevant settings like node executors and SSH key paths that affect job execution.
Rundeck before 6.2.0 contains a path traversal vulnerability that allows users holding only the project configure ACL to read arbitrary server files by setting resources.source.N.config.file to any absolute path. Attackers can retrieve file contents through editProjectNodeSourceFile or the apiSourceGetContent endpoint to obtain database passwords, LDAP bind credentials, and other projects' data.
Rundeck before 6.2.0 contains an OS command injection vulnerability that allows authenticated users with job run permission to execute commands on Windows nodes by supplying crafted option values. Attackers can inject cmd.exe metacharacters such as && or | into free-text options, which CLIUtils.quoteWindowsCMDArg wraps in ineffective single quotes, running commands with node executor credential privileges.
Discovery: OSV.dev, NVD and Red Hat (MITRE-refined). Prioritisation: CISA KEV & EPSS. Findings are best-effort from public sources and are not a substitute for vendor advisories.
Not sure what to type? Start from the product
The software directory has a page for 1000 widely used products, from operating systems and firewalls to the npm and Python packages inside your applications, each with the versions already checked and the advisories they turned up.
Scanning a whole estate?
Our Vulnerability Reporter service inventories your software and reports continuously.