Vulnerability · Published Apr 14, 2022 · Assigned by mitre
CVE-2021-43286
High 8.8
In plain English
A high-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.9% (higher than 87% of all known vulnerabilities).
Severity (CVSS NVD)8.8High
Exploit odds (30 days)2.9%top 13.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
An issue was discovered in ThoughtWorks GoCD before 21.3.0. An attacker with privileges to create a new pipeline on a GoCD server can abuse a command-line injection in the Git URL "Test Connection" feature to execute arbitrary code.
Affected products (as reported)
References
- https://www.gocd.org/releases/#21-3-0 x_refsource_MISC
- https://github.com/gocd/gocd/commit/2b77b533abcbb79c8fc758dec9984305dc1ade42 x_refsource_MISC
- https://github.com/gocd/gocd/commit/6fa9fb7a7c91e760f1adc2593acdd50f2d78676b x_refsource_MISC
- https://blog.sonarsource.com/gocd-vulnerability-chain x_refsource_MISC