Vulnerability · Published Jan 15, 2021 · Assigned by GitHub_M
CVE-2021-21244Pre-Auth SSTI via Bean validation message tampering
Critical 10.0
In plain English
A critical-severity injection in onedev from theonedev. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 75% of all known vulnerabilities).
Severity (CVSS 3.1)10.0Critical
Exploit odds (30 days)1.5%top 25.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, There is a vulnerability that enabled pre-auth server side template injection via Bean validation message tampering. Full details in the reference GHSA. This issue was fixed in 4.0.3 by disabling validation interpolation completely.
Affected products (as reported)
Weakness: CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N