CVE-2021-39132

Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to version 3.3.14 and version 3.4.3, an authorized user can upload a zip-format plugin with a crafted plugin.yaml, or a crafted aclpolicy yaml file, or upload an untrusted project archive with ...

CVE-2021-39132

CVE-2021-39132 affects Rundeck prior to versions 3.3.14 and 3.4.3. An authorized user can upload a crafted zip plugin (plugin.yaml) or crafted aclpolicy files, or an untrusted project archive with a crafted aclpolicy, potentially causing the server to run untrusted code (Community/Enterprise). An...