ByteOS Network

NVD Vulnerability Details :

CVE-2021-41111

Analyzed

Source-security-advisories@github.com

Published At-28 Feb, 2022 | 20:15

Updated At-10 Mar, 2022 | 16:51

Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to versions 3.4.5 and 3.3.15, an authenticated user with authorization to read webhooks in one project can craft a request to reveal Webhook definitions and tokens in another project. The user could use the revealed webhook tokens to trigger webhooks. Severity depends on trust level of authenticated users and whether any webhooks exist that trigger sensitive actions. There are patches for this vulnerability in versions 3.4.5 and 3.3.15. There are currently no known workarounds.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	5.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Secondary	3.1	6.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary	2.0	5.5	MEDIUM	AV:N/AC:L/Au:S/C:P/I:P/A:N

CPE Matches

pagerduty>>rundeck>>Versions before 3.3.15(exclusive)

cpe:2.3:a:pagerduty:rundeck:*:*:*:*:-:*:*:*

pagerduty>>rundeck>>Versions from 3.4.0(inclusive) to 3.4.5(exclusive)

cpe:2.3:a:pagerduty:rundeck:*:*:*:*:-:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-639	Primary	security-advisories@github.com

References

Hyperlink	Source	Resource
https://github.com/rundeck/rundeck/commit/a3bdc06a0731da902593732022a5b9d2b4facec5	security-advisories@github.com	Patch Third Party Advisory
https://github.com/rundeck/rundeck/security/advisories/GHSA-mfqj-f22m-gv8j	security-advisories@github.com	Third Party Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History