CVE-2021-39133

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to version 3.3.14 and version 3.4.3, a user with `admin` access to the `system` resource type is potentially vulnerable to a CSRF attack that could cause the server to run untrusted code on all Rundeck editions. Patches are available in Rundeck versions 3.4.3 and 3.3.14.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published
Aug 30, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-391347.8`@npmcli/arborist`, the library that calculates dependency trees and manages the `node_modules` folder hierarchy for the npm command line inCVE-2021-391357.8`@npmcli/arborist`, the library that calculates dependency trees and manages the node_modules folder hierarchy for the npm command line inteCVE-2021-391365.4baserCMS is an open source content management system with a focus on Japanese language support. In affected versions there is a cross-site sCVE-2021-391377.5go-ethereum is the official Go implementation of the Ethereum protocol. In affected versions a consensus-vulnerability in go-ethereum (Geth)CVE-2021-391386.5Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Developers can use the REST API to sCVE-2021-391398.8XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker CVE-2021-39146.1It was found that the smallrye health metrics UI component did not properly sanitize some user inputs. An attacker could use this flaw to coCVE-2021-391406.3XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker CVE-2021-391418.5XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker CVE-2021-391437.1Spinnaker is an open source, multi-cloud continuous delivery platform. A path traversal vulnerability was discovered in uses of TAR files byCVE-2021-391448.5XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker CVE-2021-391458.5XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker