CVE-2024-56321

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://github.com/gocd/gocd/commit/631f315d17fcb73f310eee6c881974c9b55ca9f0", "name": "https://github.com/gocd/gocd/commit/631f315d17fcb73f310eee6c881974c9b55ca9f0", "tags": ["Patch"], "refsource": ""}, {"url": "https://github.com/gocd/gocd/releases/tag/24.5.0", "name": "https://github.com/gocd/gocd/releases/tag/24.5.0", "tags": ["Release Notes"], "refsource": ""}, {"url": "https://github.com/gocd/gocd/security/advisories/GHSA-7jr3-gh3w-vjxq", "name": "https://github.com/gocd/gocd/security/advisories/GHSA-7jr3-gh3w-vjxq", "tags": ["Vendor Advisory"], "refsource": ""}, {"url": "https://www.gocd.org/releases/#24-5-0", "name": "https://www.gocd.org/releases/#24-5-0", "tags": ["Release Notes"], "refsource": ""}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "GoCD is a continuous deliver server. GoCD versions 18.9.0 through 24.4.0 (inclusive) can allow GoCD admins to abuse the backup configuration \"post-backup script\" feature to potentially execute arbitrary scripts on the hosting server or container as GoCD's user, rather than pre-configured scripts. In practice the impact of this vulnerability is limited, as in most configurations a user who can log into the GoCD UI as an admin also has host administration permissions for the host/container that GoCD runs on, in order to manage artifact storage and other service-level configuration options. Additionally, since a GoCD admin has ability to configure and schedule pipelines tasks on all GoCD agents available to the server, the fundamental functionality of GoCD allows co-ordinated task execution similar to that of post-backup-scripts. However in restricted environments where the host administration is separated from the role of a GoCD admin, this may be unexpected. The issue is fixed in GoCD 24.5.0. Post-backup scripts can no longer be executed from within certain sensitive locations on the GoCD server. No known workarounds are available."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-36"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2024-56321", "ASSIGNER": "security-advisories@github.com"}}, "impact": {}, "publishedDate": "2025-01-03T16:15Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:thoughtworks:gocd:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "24.5.0", "versionStartIncluding": "18.9.0"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2025-08-01T20:03Z"}