CVE-2021-21242

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is a critical vulnerability which can lead to pre-auth remote code execution. AttachmentUploadServlet deserializes untrusted data from the Attachment-Support header. This Servlet does not enforce any authentication or...

CVE-2021-21242 Pre-Auth Unsafe Deserialization on AttachmentUploadServet

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is a critical vulnerability which can lead to pre-auth remote code execution. AttachmentUploadServlet deserializes untrusted data from the Attachment-Support header. This Servlet does not enforce any authentication or...

CVE-2021-21242

CVE-2021-21242 affects OneDev before version 4.0.3. The vulnerability lies in the AttachmentUploadServlet which deserializes untrusted data from the Attachment-Support header and does not enforce authentication/authorization, enabling pre-auth remote code execution. The issue is fixed in 4.0.3 by...