CVSS 3.1
6.8 mediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:HCVE-2021-39133
Medium (6.8) in pagerduty rundeck. EPSS 0.5% chance of exploitation in the next 30 days. Fixed in org.rundeck:rundeck-core 3.3.14, 3.4.3.
Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to version 3.3.14 and version 3.4.3, a user with `admin` access to the `system` resource type is potentially vulnerable to a CSRF attack that could cause the server to run untrusted code on all Rundeck editions. Patches are available in Rundeck versions 3.4.3 and 3.3.14.
Severity
- EPSS
- 0.5% chance of exploitation in the next 30 days; higher than 39% of CVEs (scores of 2026-10-31)
- CWE
- CWE-352
- Published
- Modified
- Record from
- the NVD, synced
Affected
- pagerduty:rundeck
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-3jmw-c69h-426c | Maven | org.rundeck:rundeck-core | >=3.4.0 <3.4.3 | 3.4.3 |
| GHSA-3jmw-c69h-426c | Maven | org.rundeck:rundeck-core | <3.3.14 | 3.3.14 |
References
- https://github.com/rundeck/rundeck/commit/67c4eedeaf9509fc0b255aff15977a5229ef13b9
- https://github.com/rundeck/rundeck/security/advisories/GHSA-3jmw-c69h-426c
- https://github.com/rundeck/rundeck/commit/67c4eedeaf9509fc0b255aff15977a5229ef13b9
- https://github.com/rundeck/rundeck/security/advisories/GHSA-3jmw-c69h-426c