Lucene search

GitHub_MCVELIST:CVE-2021-21243

HistoryJan 15, 2021 - 8:05 p.m.

CVE-2021-21243 Pre-Auth Unsafe Deserialization on KubernetesResource

2021-01-1520:05:21

CWE-74

GitHub_M

www.cve.org

kubernetesresource untrusteddata preauthrce authenticationauthorizationchecks endpointfix

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

AI Score

9.7

Confidence

High

EPSS

0.016

Percentile

87.3%

JSON

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, a Kubernetes REST endpoint exposes two methods that deserialize untrusted data from the request body. These endpoints do not enforce any authentication or authorization checks. This issue may lead to pre-auth RCE. This issue was fixed in 4.0.3 by not using deserialization at KubernetesResource side.

CNA Affected

[
  {
    "product": "onedev",
    "vendor": "theonedev",
    "versions": [
      {
        "status": "affected",
        "version": "< 4.0.3"
      }
    ]
  }
]

References

github.com/theonedev/onedev/commit/9637fc8fa461c5777282a0021c3deb1e7a48f137

github.com/theonedev/onedev/security/advisories/GHSA-9mmq-fm8c-q4fv

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

AI Score

9.7

Confidence

High

EPSS

0.016

Percentile

87.3%

JSON

Related for CVELIST:CVE-2021-21243