CVE-2021-39133: Cross-Site Request Forgery (CSRF) can run untrusted code on Rundeck server
Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to version 3.3.14 and version 3.4.3, a user with admin access to the system resource type is potentially vulnerable to a CSRF attack that could cause the server to run untrusted code on all Rundeck editions. Patches are available in Rundeck versions 3.4.3 and 3.3.14.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Rundeckto a version that resolves this vulnerability.Fixed in 3.4.3 - Upgrade
Upgrade
Rundeckto a version that resolves this vulnerability.Fixed in 3.3.14
Event History
Frequently Asked Questions
What is CVE-2021-39133?
CVE-2021-39133 is a vulnerability in Rundeck that allows a user with admin access to the system resource type to be potentially vulnerable to a CSRF attack, which could cause the server to run untrusted code on all Rundeck instances.
How does CVE-2021-39133 affect Rundeck?
CVE-2021-39133 affects Rundeck versions prior to 3.3.14 and versions 3.4.0 to 3.4.3. Users with admin access to the system resource type are potentially vulnerable to a CSRF attack.
What is the severity of CVE-2021-39133?
CVE-2021-39133 has a severity keyword of 'high' and a severity value of 6.8.
How can I fix CVE-2021-39133?
To fix CVE-2021-39133, it is recommended to update Rundeck to version 3.3.14 or version 3.4.3, which contain the necessary security fixes.
What is the CWE for CVE-2021-39133?
The CWE (Common Weakness Enumeration) for CVE-2021-39133 is 352.