CVE-2021-39133

Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to version 3.3.14 and version 3.4.3, a user with admin access to the system resource type is potentially vulnerable to a CSRF attack that could cause the server to run untrusted code on all...

be.fluid-it.tools.rundeck.plugins:rundeck-httppost-plugin (=0.1-1), com.criteo.rundeck.plugin:rundeck-tag-orchestrator-plugin (=1.3.3) +4 more potentially affected by CVE-2021-39133 via org.rundeck:rundeck-core (>=1.5 <=2.5.2)

org.rundeck:rundeck-core MAVEN version =1.5, =1.0.0, =1, =1.1, =1.3.3 - org.rundeck:rundeckapp =1.5 Source cves: CVE-2021-39133 Source advisory: OSV:GHSA-3JMW-C69H-426C...

CVE-2021-39133

creationtimestamp| type| source ---|---|--- 2021-08-31 00:32:45+00:00| seen| https://t.me/cibsecurity/28053...

CVE-2021-39133

Summary: CVE-2021-39133 affects Rundeck; prior to versions 3.3.14 and 3.4.3 a user with admin access to the system resource type could be CSRF-ed into causing the server to run untrusted code. The issue exposes all Rundeck editions to potential code execution via CSRF. Affected versions: Rundeck ...

CVE-2021-39133 Cross-Site Request Forgery (CSRF) can run untrusted code on Rundeck server

Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to version 3.3.14 and version 3.4.3, a user with admin access to the system resource type is potentially vulnerable to a CSRF attack that could cause the server to run untrusted code on all...