GoCD information disclosure (CVE-2021-43287)
Description
GoCD versions with the Business Continuity add-on contain an information disclosure vulnerability (CVE-2021-43287) that allows unauthenticated remote attackers to access sensitive configuration files and credentials. This vulnerability can be exploited without authentication, enabling attackers to retrieve critical system information that may lead to complete server compromise.
Remediation
Immediately upgrade GoCD to a patched version that addresses CVE-2021-43287. If the Business Continuity add-on is not required, disable or remove it until the upgrade can be completed. After upgrading, rotate all credentials, API tokens, and secrets that may have been exposed, including repository access tokens, deployment keys, and service account credentials. Review access logs for any suspicious activity or unauthorized file access prior to remediation.