CVE-2021-39133

    Dashboard / Vulnerabilities / CVE-2021-39133

    CVE-2021-39133

    Published: 30 Aug 2021Last Modified: 9 Jul 2026

    Summary:

    Details: Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to version 3.3.14 and version 3.4.3, a user with `admin` access to the `system` resource type is potentially vulnerable to a CSRF attack that could cause the server to run untrusted code on all Rundeck editions. Patches are available in Rundeck versions 3.4.3 and 3.3.14.

    References: https://github.com/rundeck/rundeck/security/advisories/GHSA-3jmw-c69h-426c, https://github.com/rundeck/rundeck/commit/67c4eedeaf9509fc0b255aff15977a5229ef13b9

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -6004a99ec04b1ec208354d05124664b3c37f906b

    Affected versions

    v3.3.14-rc1
    v3.3.12
    v3.3.12-rc2
    v3.3.12-rc1
    v3.3.11
    v3.3.11-rc4
    v3.3.11-rc3
    v3.3.11-rc2
    v3.3.11-rc1
    v3.3.10
    v3.3.10-rc2
    v3.3.10-rc1
    v3.3.8
    v3.3.8-rc7
    v3.3.8-rc6
    v3.3.8-rc5
    v3.3.8-rc1
    v3.3.7
    v3.3.7-rc2
    v3.3.7-rc1
    v3.3.6
    v3.3.6-rc4
    v3.3.6-rc3
    v3.3.6-rc2
    v3.3.5
    v3.3.1
    v3.3.0
    v3.3.0-preview2
    v3.3.0-preview1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-39133 | CVE-DB