Affected Versions: < 3.4.5, < 3.3.15
Patched Versions: 3.4.5+, 3.3.15+
An authenticated user with authorization to read webhooks in one project, can craft a request to reveal Webhook definitions and tokens in another project. The user could use the revealed webhook tokens to trigger webhooks.
Severity depends on trust level of authenticated users, and whether any webhooks exist that trigger sensitive actions.
Patched in release 3.4.5+, 3.3.15+
For more information If you have any questions or comments about this advisory:
Email us at firstname.lastname@example.org To report security issues to Rundeck please use the form at http://rundeck.com/security