GHSA-4262-wr7p-gpcj

Rundeck Community Edition vulnerable to Cross-site Scripting

Source: GitHub Advisory Database (reviewed) Moderate CVE-2019-6804

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.rundeck:rundeck	< 3.0.13	3.0.13

Details

As written in the advisory (Markdown source, shown as plain text).

An XSS issue was discovered on the Job Edit page in Rundeck Community Edition before 3.0.13, related to assets/javascripts/workflowStepEditorKO.js and views/execution/_wfitemEdit.gsp.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-6804 advisory
https://github.com/rundeck/rundeck/issues/4406 web
https://github.com/rundeck/rundeck/commit/e992e94bba22d9fca3a669f0d02c85b80a19f848 web
https://docs.rundeck.com/docs/history/version-3.0.13.html web
https://github.com/rundeck/rundeck package
https://www.exploit-db.com/exploits/46251 web