CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
Percentile
48.8%
An attacker can post malformed webhook data which leads to an update of the repository data that can e.g. allow the takeover of a repository.
This is only critical if the CI is configured for public usage and connected to a forge witch is also in public usage.
Please use either next or the latest v1.0 e.g. v1.0.2
Secure the CI system by making it inaccessible to untrusted entities, for example, by placing it behind a firewall.
Fix: https://github.com/woodpecker-ci/woodpecker/pull/2221
Backport: https://github.com/woodpecker-ci/woodpecker/pull/2222
Vendor | Product | Version | CPE |
---|---|---|---|
woodpecker-ci | woodpecker | * | cpe:2.3:a:woodpecker-ci:woodpecker:*:*:*:*:*:*:*:* |
github.com/advisories/GHSA-4gcf-5m39-98mc
github.com/woodpecker-ci/woodpecker/commit/6e4c2f84cc84661d58cf1c0e5c421a46070bb105
github.com/woodpecker-ci/woodpecker/pull/2221
github.com/woodpecker-ci/woodpecker/pull/2222
github.com/woodpecker-ci/woodpecker/releases/tag/v1.0.2
github.com/woodpecker-ci/woodpecker/security/advisories/GHSA-4gcf-5m39-98mc
nvd.nist.gov/vuln/detail/CVE-2023-40034