GHSA-3jmw-c69h-426cHighCVSS 7.2

Cross-Site Request Forgery (CSRF) can run untrusted code on Rundeck server

Published
September 1, 2021
Last Modified
February 1, 2023

🔗 CVE IDs covered (1)

CVE-2021-39133 →

📋 Description

Impact

A user with admin access to the system resource type is potentially vulnerable to a CSRF attack that could cause the server to run untrusted code on all Rundeck editions.

Patches

Available in Rundeck 3.4.3 and 3.3.14

Workarounds

Please visit https://rundeck.com/security for information about specific workarounds.

For more information

If you have any questions or comments about this advisory:

To report security issues to Rundeck please use the form at https://rundeck.com/security

🎯 Affected products2

  • maven/org.rundeck:rundeck-core:>= 3.4.0, < 3.4.3
  • maven/org.rundeck:rundeck-core:< 3.3.14

🔗 References (4)