CVE-2023-28629
CVE-2023-28629 — Stored XSS possible on VSM and Job Details pages via malicious pipeline label configuration in gocd
GoCD is an open source continuous delivery server. GoCD versions before 23.1.0 are vulnerable to a stored XSS vulnerability, where pipeline configuration with a malicious pipeline label configuration can affect browser display of pipeline runs generated from that configuration. An attacker that has permissions to configure GoCD pipelines could include JavaScript elements within the label template, causing a XSS vulnerability to be triggered for any users viewing the Value Stream Map or Job Details for runs of the affected pipeline, potentially allowing them to perform arbitrary actions within the victim's browser context rather than their own. This issue has been fixed in GoCD 23.1.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Published Updated Sources: cvelistV5, GitHub_M
Triage
Is it exploited, how likely is exploitation, what does it touch, and how severe do the scoring sources call it.
Exploitation
Unreported
no source claims exploitation
EPSS
0%
chance of exploitation in 30 days
CVSS base
5.4
MEDIUM
CISA SSVC assessment
Three decision points CISA publishes for the CVEs it assesses · SSVC 2.0.3. A stakeholder decision, not a severity score.
Exploitation
None
none · proof-of-concept · active
Automatable
No
can an attacker script all four kill-chain steps
Technical impact
Partial
partial · total control of the vulnerable component
Affected scope
The catalog records vendors and products as separate lists, not pairs, so which product belongs to which vendor is not something this page can say.
Vendors (1)
Products (1)
Every base score collected
Sources score independently and disagree; each row says who scored it and under which version.
| Score | Version | Severity | Expl. | Impact | Source |
|---|---|---|---|---|---|
| 5.4 | CVSS 3.1 | MEDIUM | — | — | cvelistV5 |
Weakness & attack patterns
- CWE-79
References
6 on the record
- github.com/gocd/gocd/security/advisories/GHSA-3vvg-gjfr-q9vm
x_refsource_CONFIRM
- github.com/gocd/gocd/commit/95f758229d419411a38577608709d8552cccf193
x_refsource_MISC
- github.com/gocd/gocd/commit/c6aa644973b034305bbe9ea34b010dcf5b5790ce
x_refsource_MISC
- docs.gocd.org/current/configuration/pipeline_labeling.html
x_refsource_MISC
- github.com/gocd/gocd/releases/tag/23.1.0
x_refsource_MISC
- www.gocd.org/releases/#23-1-0
x_refsource_MISC
Elsewhere on this site
Not in any source we poll
Listed rather than left blank: an empty field and an unmeasured one look identical on screen, and only one is a reason to look elsewhere.
- No confirmed IOCs, IP addresses, domains, file hashes, or malware artifacts supplied.
- No organization-specific asset inventory, compensating-control status, or patch deployment evidence supplied.
- No exploit packet captures, log samples, or incident case IDs supplied.