PT-2021-22395
CVE-2021-39133
·
تاريخ النشر
2021-08-30
·
تاريخ التحديث
2021-09-08
الوصف من
CVSS 3.1
7.2
عاليةالمقاييسAV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
Rundeck versions prior to 3.3.14
Rundeck versions prior to 3.4.3
Description
Rundeck is an open source automation service with a web console, command line tools and a WebAPI. A user with
admin access to the system resource type is potentially vulnerable to a CSRF attack that could cause the server to run untrusted code on all Rundeck editions.Recommendations
For versions prior to 3.3.14, update to version 3.3.14 or later.
For versions prior to 3.4.3, update to version 3.4.3 or later.
As a temporary workaround, consider restricting access to the
system resource type for users with admin access until a patch is applied. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾