Vulnerability · Published Aug 30, 2021 · Assigned by GitHub_M
CVE-2021-39133Cross-Site Request Forgery (CSRF) can run untrusted code on Rundeck server
High 7.2
In plain English
A high-severity cross-site request forgery in rundeck from rundeck. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to version 3.3.14 and version 3.4.3, a user with `admin` access to the `system` resource type is potentially vulnerable to a CSRF attack that could cause the server to run untrusted code on all Rundeck editions. Patches are available in Rundeck versions 3.4.3 and 3.3.14.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.rundeck:rundeck-core | 3.4.3 | GHSA-3jmw-c69h-426c |
| Maven | org.rundeck:rundeck-core | 3.3.14 | GHSA-3jmw-c69h-426c |
Affected products (as reported)
Weakness: CWE-352 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H