// For flags

CVE-2021-41112

Missing Authorization in Rundeck

Severity Score

8.1
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Rundeck is an open source automation service with a web console, command line tools and a WebAPI. In versions prior to 3.4.5, authenticated users could craft a request to modify or delete System or Project level Calendars, without appropriate authorization. Modifying or removing calendars could cause Scheduled Jobs to execute, or not execute on desired calendar days. Severity depends on trust level of authenticated users and impact of running or not running scheduled jobs on days governed by calendar definitions. Version 3.4.5 contains a patch for this issue. There are currently no known workarounds.

Rundeck es un servicio de automatización de código abierto con una consola web, herramientas de línea de comandos y una WebAPI. En versiones anteriores a 3.4.5, los usuarios autenticados podían diseñar una petición para modificar o eliminar calendarios a nivel de sistema o de proyecto, sin la autorización correspondiente. La modificación o eliminación de calendarios podía causar que los trabajos programados fueran ejecutados, o que no fueran ejecutados en los días de calendario deseados. La gravedad depende del nivel confiable de los usuarios autenticados y del impacto de ejecutar o no ejecutar trabajos programados en los días regidos por las definiciones de calendario. La versión 3.4.5 contiene un parche para este problema. Actualmente no se presentan medidas de mitigación conocidas.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
Single
Confidentiality
None
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2021-09-15 CVE Reserved
  • 2022-02-28 CVE Published
  • 2023-09-21 EPSS Updated
  • 2024-08-04 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-862: Missing Authorization
CAPEC
References (1)
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Pagerduty
Search vendor "Pagerduty"
Rundeck
Search vendor "Pagerduty" for product "Rundeck"
< 3.4.5
Search vendor "Pagerduty" for product "Rundeck" and version " < 3.4.5"
-
Affected