CVE-2021-41111

    Dashboard / Vulnerabilities / CVE-2021-41111

    CVE-2021-41111

    Published: 28 Feb 2022Last Modified: 20 Oct 2026

    Summary:

    Details: Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to versions 3.4.5 and 3.3.15, an authenticated user with authorization to read webhooks in one project can craft a request to reveal Webhook definitions and tokens in another project. The user could use the revealed webhook tokens to trigger webhooks. Severity depends on trust level of authenticated users and whether any webhooks exist that trigger sensitive actions. There are patches for this vulnerability in versions 3.4.5 and 3.3.15. There are currently no known workarounds.

    References: https://github.com/rundeck/rundeck/security/advisories/GHSA-mfqj-f22m-gv8j, https://github.com/rundeck/rundeck/commit/a3bdc06a0731da902593732022a5b9d2b4facec5

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -2de184404a7bf75a94e7fca5c1ae27335dc04a31

    Affected versions

    v3.3.12
    v3.3.12-rc2
    v3.3.12-rc1
    v3.3.11
    v3.3.11-rc4
    v3.3.11-rc3
    v3.3.11-rc2
    v3.3.11-rc1
    v3.3.10
    v3.3.10-rc2
    v3.3.10-rc1
    v3.3.8
    v3.3.8-rc7
    v3.3.8-rc6
    v3.3.8-rc5
    v3.3.8-rc1
    v3.3.7
    v3.3.7-rc2
    v3.3.7-rc1
    v3.3.6
    v3.3.6-rc4
    v3.3.6-rc3
    v3.3.6-rc2
    v3.3.5
    v3.3.1
    v3.3.0
    v3.3.0-preview2
    v3.3.0-preview1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-41111 | CVE-DB