Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2022-29184
CVE-2022-29184:
GoCD Server vulnerability analysis and mitigation
Overview
CVE-2022-29184 affects GoCD, a continuous delivery server, in versions prior to 22.1.0. The vulnerability allows authenticated users with specific permissions to achieve remote code execution on the GoCD server through malicious branch name configuration that exploits Mercurial hooks/aliases via command injection (GitHub Advisory).
Technical details
The vulnerability is classified as a command injection weakness (CWE-77 and CWE-88) with a CVSS v3.1 base score of 8.8 HIGH (Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The attack requires an authenticated user with GoCD administration permissions to either create/edit Mercurial-based configuration repositories, create/edit pipelines with Mercurial-based materials, or commit malicious configuration to external repositories that will be parsed into pipeline configurations (GitHub Advisory).
Impact
If successfully exploited, this vulnerability allows attackers to execute arbitrary code on the GoCD server, potentially leading to complete system compromise with high impact on confidentiality, integrity, and availability of the server (GitHub Advisory).
Mitigation and workarounds
The vulnerability is fixed in GoCD version 22.1.0. As a workaround for users who cannot immediately upgrade, those who do not use Mercurial materials can uninstall or remove the hg/Mercurial binary from the underlying GoCD Server operating system or Docker image (GitHub Advisory).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management