CVE-2022-36088

GoCD is a continuous delivery server. Windows installations via either the server or agent installers for GoCD prior to 22.2.0 do not adequately restrict permissions when installing outside of the default location. This could allow a malicious user with local access to the server GoCD Server or Agent are installed on to modify executables or components of the installation. This does not affect zip file-based installs, installations to other platforms, or installations inside `Program Files` or `Program Files (x86)`. This issue is fixed in GoCD 22.2.0 installers. As a workaround, if the server or agent is installed outside of `Program Files (x86)`, verify the the permission of the Server or Agent installation directory to ensure the `Everyone` user group does not have `Full Control`, `Modify` or `Write` permissions.

• CWE-269
• CWE-284

• https://github.com/gocd/gocd/commit/96add9605096ab50c5cd4c229be1d503aff506a6Patch, Third Party Advisory
• https://github.com/gocd/gocd/releases/tag/22.2.0Release Notes, Third Party Advisory
• https://github.com/gocd/gocd/security/advisories/GHSA-gpv4-xqhc-5vcjMitigation, Third Party Advisory
• https://www.gocd.org/releases/#22-2-0Release Notes, Third Party Advisory
• https://github.com/gocd/gocd/commit/96add9605096ab50c5cd4c229be1d503aff506a6Patch, Third Party Advisory
• https://github.com/gocd/gocd/releases/tag/22.2.0Release Notes, Third Party Advisory
• https://github.com/gocd/gocd/security/advisories/GHSA-gpv4-xqhc-5vcjMitigation, Third Party Advisory
• https://www.gocd.org/releases/#22-2-0Release Notes, Third Party Advisory

Published

Sep 7, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-36082mangadex-downloader is a command-line tool to download manga…5.3
• CVE-2022-36083JOSE is "JSON Web Almost Everything" - JWA, JWS, JWE, JWT, J…5.3
• CVE-2022-36084cruddl is software for creating a GraphQL API for a database…8.8
• CVE-2022-36085Open Policy Agent (OPA) is an open source, general-purpose p…9.8
• CVE-2022-36086linked_list_allocator is an allocator usable for no_std syst…9.8
• CVE-2022-36087OAuthLib is an implementation of the OAuth request-signing l…6.5
• CVE-2022-36089KubeVela is an application delivery platform Users using Kub…9.8
• CVE-2022-3609The GetYourGuide Ticketing WordPress plugin before 1.0.4 doe…4.8
• CVE-2022-36090XWiki Platform Old Core is a core package for XWiki Platform…8.1
• CVE-2022-36091XWiki Platform Web Templates are templates for XWiki Platfor…7.5
• CVE-2022-36092XWiki Platform Old Core is a core package for XWiki Platform…7.5
• CVE-2022-36093XWiki Platform Web Templates are templates for XWiki Platfor…7.1