Back to Database
Status published
High
CVE-2021-39133
Cross-Site Request Forgery (CSRF) can run untrusted code on Rundeck server
Vulnerability Description
Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to version 3.3.14 and version 3.4.3, a user with `admin` access to the `system` resource type is potentially vulnerable to a CSRF attack that could cause the server to run untrusted code on all Rundeck editions. Patches are available in Rundeck versions 3.4.3 and 3.3.14.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-39133
Credits & Attribution
No credits recorded in the NVD database.
References
More from rundeck
View All →CVE-2023-48222
Authenticated users can view or delete jobs they do not have authorization for in Rundeck
High
8.1
CVE-2023-47112
Authenticated users can view job names and groups they do not have authorization to view in Rundeck
Medium
4.3
CVE-2022-31044
Plaintext Storage of Keys and Passwords in Rundeck and PagerDuty Process Automation
High
7.5
CVE-2022-29186
Use of Hard-coded Cryptographic Key in rundeck/rundeck, rundeckpro/enterprise
Critical
9.1
CVE-2021-41112
Missing Authorization in Rundeck
High
8.1
Affected Vendor
rundeck
View all reports →Affected Software
rundeck
Vulnerable Versions:
< 3.3.14, >= 3.4.0, < 3.4.3
Timeline
Official Publish:
August 30th, 2021
Last Modified:
August 4th, 2024
Added to House:
July 21st, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H