CVE-2021-39133

Name of the Vulnerable Software and Affected Versions Rundeck versions prior to 3.3.14 Rundeck versions prior to 3.4.3

Description Rundeck is an open source automation service with a web console, command line tools and a WebAPI. A user with admin access to the system resource type is potentially vulnerable to a CSRF attack that could cause the server to run untrusted code on all Rundeck editions.

Recommendations For versions prior to 3.3.14, update to version 3.3.14 or later. For versions prior to 3.4.3, update to version 3.4.3 or later. As a temporary workaround, consider restricting access to the system resource type for users with admin access until a patch is applied.