CVE-2022-29183

    Dashboard / Vulnerabilities / CVE-2022-29183

    CVE-2022-29183

    Published: 20 May 2022Last Modified: 12 Aug 2026

    Summary: Reflected XSS in GoCD

    Details: GoCD is a continuous delivery server. GoCD versions 20.2.0 until 21.4.0 are vulnerable to reflected cross-site scripting via abuse of the pipeline comparison function's error handling to render arbitrary HTML into the returned page. This could allow an attacker to trick a victim into executing code which would allow the attacker to operate on, or gain control over the same resources as the victim had access to. This issue is fixed in GoCD 21.4.0. As a workaround, block access to `/go/compare/.*` prior to GoCD Server via a reverse proxy, web application firewall or equivalent, which would prevent use of the pipeline comparison function.

    References: https://github.com/gocd/gocd/pull/9829/commits/bda81084c0401234b168437cf35a63390e3064d1, https://github.com/gocd/gocd/releases/tag/21.4.0, https://www.gocd.org/releases/#21-4-0, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29183.json, https://github.com/gocd/gocd/security/advisories/GHSA-3vvq-q4qv-x2gf, https://nvd.nist.gov/vuln/detail/CVE-2022-29183

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0cb6660ad91a19a4064e6537374c896506add24a
    Fixed -f3b865c5018dec2bddf98496e0e74e8e70a80cb6

    Affected versions

    21.3.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-29183 | CVE-DB