CVE Feed

    Dashboard / CVE / CVE-2021-39133

    CVE-2021-39133

    Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to version 3.3.14 and version 3.4.3, a user with `admin` access to the `system` resource type is potentially vulnerable to a CSRF attack that could cause the server to run untrusted code on all Rundeck editions. Patches are available in Rundeck versions 3.4.3 and 3.3.14.

    Published:Aug 30, 2021
    Last Modified:Nov 21, 2024
    EPS:Aug 30, 2021
    EPSS Score:0.00147
    CVSS Score:7.2

    Affected Products

    Vendor
    Pagerduty
    Product
    Rundeck

    Exploits

    No exploit reference

    Related CVEs

    CVE-2023-47112 (CVSS 4.3) — Rundeck is an open source automation service with a web console, command line tools and a WebAPI. In affected …
    CVE-2023-48222 (CVSS 8.1) — Rundeck is an open source automation service with a web console, command line tools and a WebAPI. In affected …
    CVE-2022-31044 (CVSS 7.5) — Rundeck is an open source automation service with a web console, command line tools and a WebAPI. The Key Stor…
    CVE-2022-29186 (CVSS 9.1) — Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Rundeck comm…
    CVE-2021-41112 (CVSS 8.1) — Rundeck is an open source automation service with a web console, command line tools and a WebAPI. In versions …
    CVE-2021-41111 (CVSS 6.4) — Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to ver…
    CVE-2021-39132 (CVSS 8.8) — Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to ver…
    CVE-2020-11009 (CVSS 6.5) — In Rundeck before version 3.2.6, authenticated users can craft a request that reveals Execution data and logs …
    CVE-2019-6804 (CVSS 6.1) — An XSS issue was discovered on the Job Edit page in Rundeck Community Edition before 3.0.13, related to assets…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High