PT-2021-22395 · Rundeck · Rundeck

Fdevans · Published 2021-08-30 · Updated 2021-09-08 · CVE-2021-39133

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Rundeck versions prior to 3.3.14 Rundeck versions prior to 3.4.3

Description Rundeck is an open source automation service with a web console, command line tools and a WebAPI. A user with admin access to the system resource type is potentially vulnerable to a CSRF attack that could cause the server to run untrusted code on all Rundeck editions.

Recommendations For versions prior to 3.3.14, update to version 3.3.14 or later. For versions prior to 3.4.3, update to version 3.4.3 or later. As a temporary workaround, consider restricting access to the system resource type for users with admin access until a patch is applied.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2021-39133

GHSA-3JMW-C69H-426C

Affected Products

Rundeck

References · 8

• https://github.com/rundeck/rundeck/commit/67c4eedeaf9509fc0b255aff15977a5229ef13b9 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-39133 · Security Note
• https://osv.dev/vulnerability/GHSA-3jmw-c69h-426c · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-39133 · Vendor Advisory
• https://github.com/rundeck/rundeck/security/advisories/GHSA-3jmw-c69h-426c · Note
• https://github.com/rundeck/rundeck · Note
• https://t.me/cibsecurity/28053 · Telegram Post
• https://t.me/cvenotify/20387 · Telegram Post