CVE-2022-39310

GoCD is a continuous delivery server. GoCD helps you automate and streamline the build-test-release cycle for continuous delivery of your product. GoCD versions prior to 21.1.0 can allow one authenticated agent to impersonate another agent, and thus receive work packages for other agents due to broken access control and incorrect validation of agent tokens within the GoCD server. Since work packages can contain sensitive information such as credentials intended only for a given job running against a specific agent environment, this can cause accidental information disclosure. Exploitation requires knowledge of agent identifiers and ability to authenticate as an existing agent with the GoCD server. This issue is fixed in GoCD version 21.1.0. There are currently no known workarounds.

• CWE-284

• https://github.com/gocd/gocd/pull/8877Patch, Third Party Advisory
• https://github.com/gocd/gocd/security/advisories/GHSA-4fp5-33jh-hgcqPatch, Release Notes, Third Party Advisory
• https://www.gocd.org/releases/#21-1-0Release Notes, Vendor Advisory
• https://github.com/gocd/gocd/pull/8877Patch, Third Party Advisory
• https://github.com/gocd/gocd/security/advisories/GHSA-4fp5-33jh-hgcqPatch, Release Notes, Third Party Advisory
• https://www.gocd.org/releases/#21-1-0Release Notes, Vendor Advisory

Published

Oct 14, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-39305Gin-vue-admin is a backstage management system based on vue …9.8
• CVE-2022-39306Grafana is an open-source platform for monitoring and observ…8.1
• CVE-2022-39307Grafana is an open-source platform for monitoring and observ…5.3
• CVE-2022-39308GoCD is a continuous delivery server. GoCD helps you automat…5.9
• CVE-2022-39309GoCD is a continuous delivery server. GoCD helps you automat…6.5
• CVE-2022-3931Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-39311GoCD is a continuous delivery server. GoCD helps you automat…8.8
• CVE-2022-39312Dataease is an open source data visualization analysis tool.…9.8
• CVE-2022-39313Parse Server is an open source backend that can be deployed …7.5
• CVE-2022-39314Kirby is a flat-file CMS. In versions prior to 3.5.8.2, 3.6.…3.7
• CVE-2022-39315Kirby is a Content Management System. Prior to versions 3.5.…5.3
• CVE-2022-39316FreeRDP is a free remote desktop protocol library and client…5.7