CVE-2021-41112

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

Rundeck is an open source automation service with a web console, command line tools and a WebAPI. In versions prior to 3.4.5, authenticated users could craft a request to modify or delete System or Project level Calendars, without appropriate authorization. Modifying or removing calendars could cause Scheduled Jobs to execute, or not execute on desired calendar days. Severity depends on trust level of authenticated users and impact of running or not running scheduled jobs on days governed by calendar definitions. Version 3.4.5 contains a patch for this issue. There are currently no known workarounds.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Feb 28, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-411138.8TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the new TYPO3 v11 fe CVE-2021-411145.3TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that TYPO3 CMS is suscept CVE-2021-411156.5Zulip is an open source team chat server. In affected versions Zulip allows organization administrators on a server to configure "linkifiers CVE-2021-411169.8Composer is an open source dependency manager for the PHP language. In affected versions windows users running Composer to install untrusted CVE-2021-411179.1keypair is a a RSA PEM key generator written in javascript. keypair implements a lot of cryptographic primitives on its own or by borrowing CVE-2021-411187.5The DynamicPageList3 extension is a reporting tool for MediaWiki, listing category members and intersections with various formats and detail CVE-2021-411197.5Wire-server is the system server for the wire back-end services. Releases prior to v2022-03-01 are subject to a denial of service attack via CVE-2021-41128.8A flaw was found in ansible-tower where the default installation is vulnerable to job isolation escape. This flaw allows an attacker to elev CVE-2021-411207.5sylius/paypal-plugin is a paypal plugin for the Sylius development platform. In affected versions the URL to the payment page done after che CVE-2021-411218.8Vyper is a Pythonic Smart Contract Language for the EVM. In affected versions when performing a function call inside a literal struct, there CVE-2021-411224.3Vyper is a Pythonic Smart Contract Language for the EVM. In affected versions external functions did not properly validate the bounds of dec CVE-2021-411235.3Survey Solutions is a survey management and data collection system. In affected versions the Headquarters application publishes /metrics end