-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.rundeck:rundeck | maven | >= 4.12.0, < 4.17.3 | 4.17.3 |
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability stems from missing authorization checks on two specific URL patterns. In MVC frameworks like Grails (used by Rundeck), URL routes map to controller actions. The /rdJob/* and /api/*/incubator/jobs endpoints would be handled by controller methods that likely lacked @AuthorizedExecution or similar security annotations. These functions would process job operations without verifying if the authenticated user has required permissions, directly enabling the vulnerability. The confidence is high because the CWE-862 description and URL patterns strongly indicate controller-level authorization gaps.
Ongoing coverage of React2Shell