CVE-2021-41111

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to versions 3.4.5 and 3.3.15, an authenticated user with authorization to read webhooks in one project can craft a request to reveal Webhook definitions and tokens in another project. The user could use the revealed webhook tokens to trigger webhooks. Severity depends on trust level of authenticated users and whether any webhooks exist that trigger sensitive actions. There are patches for this vulnerability in versions 3.4.5 and 3.3.15. There are currently no known workarounds.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published: Feb 28, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-411128.1Rundeck is an open source automation service with a web console, command line tools and a WebAPI. In versions prior to 3.4.5, authenticated CVE-2021-411138.8TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the new TYPO3 v11 fe CVE-2021-411145.3TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that TYPO3 CMS is suscept CVE-2021-411156.5Zulip is an open source team chat server. In affected versions Zulip allows organization administrators on a server to configure "linkifiers CVE-2021-411169.8Composer is an open source dependency manager for the PHP language. In affected versions windows users running Composer to install untrusted CVE-2021-411179.1keypair is a a RSA PEM key generator written in javascript. keypair implements a lot of cryptographic primitives on its own or by borrowing CVE-2021-411187.5The DynamicPageList3 extension is a reporting tool for MediaWiki, listing category members and intersections with various formats and detail CVE-2021-411197.5Wire-server is the system server for the wire back-end services. Releases prior to v2022-03-01 are subject to a denial of service attack via CVE-2021-41128.8A flaw was found in ansible-tower where the default installation is vulnerable to job isolation escape. This flaw allows an attacker to elev CVE-2021-411207.5sylius/paypal-plugin is a paypal plugin for the Sylius development platform. In affected versions the URL to the payment page done after che CVE-2021-411218.8Vyper is a Pythonic Smart Contract Language for the EVM. In affected versions when performing a function call inside a literal struct, there CVE-2021-411224.3Vyper is a Pythonic Smart Contract Language for the EVM. In affected versions external functions did not properly validate the bounds of dec