cve.bz

CVE-2021-21244

9.8 criticalEPSS 1.5%

Critical (9.8) in onedev project onedev. EPSS 1.5% chance of exploitation in the next 30 days.

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, There is a vulnerability that enabled pre-auth server side template injection via Bean validation message tampering. Full details in the reference GHSA. This issue was fixed in 4.0.3 by disabling validation interpolation completely.

Severity

CVSS 3.1

9.8 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
1.5% chance of exploitation in the next 30 days; higher than 74% of CVEs (scores of 2026-10-31)
CWEs
CWE-94, CWE-74
Published
Modified
Record from
the NVD, synced

Affected

References

Check your stackJSON