Woodpecker is a simple yet powerful CI/CD engine with great extensibility. The server allow to create any user who can trigger a pipeline run malicious workflows: 1. Those workflows can either lead to a host takeover that runs the agent executing the workflow. 2. Or allow to extract the secrets who would be normally provided to the plugins who's entrypoint are overwritten. This issue has been addressed in release version 2.7.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
References
Configurations
History
03 Oct 2024, 15:57
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:woodpecker-ci:woodpecker:*:*:*:*:*:*:*:* | |
| CWE | NVD-CWE-noinfo | |
| References | () https://github.com/woodpecker-ci/woodpecker-security/issues/8 - Broken Link | |
| References | () https://github.com/woodpecker-ci/woodpecker/issues/3924 - Patch | |
| References | () https://github.com/woodpecker-ci/woodpecker-security/issues/9 - Broken Link | |
| References | () https://github.com/woodpecker-ci/woodpecker/security/advisories/GHSA-xw35-rrcp-g7xm - Third Party Advisory | |
| References | () https://github.com/woodpecker-ci/woodpecker-security/pull/11 - Broken Link | |
| References | () https://github.com/woodpecker-ci/woodpecker/pull/3933 - Patch | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
| First Time |
Woodpecker-ci woodpecker
Woodpecker-ci |
19 Jul 2024, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-07-19 20:15
Updated : 2024-10-03 15:57
NVD link : CVE-2024-41121
Mitre link : CVE-2024-41121
JSON object : View
Products Affected
woodpecker-ci
- woodpecker
CWE