CRITICAL🇬🇧 English

CVE-2021-21244

CVSS 10.0v3.1pub. 2021-01-15upd. 2024-11-21

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, There is a vulnerability that enabled pre-auth server side template injection via Bean validation message tampering. Full details in the reference GHSA. This issue was fixed in 4.0.3 by disabling validation interpolation completely.

oryginał EN
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

  • Onedev Project Onedev

    APP
    Onedev Project
    < 4.0.3
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
CWE
Referencje

Powiązane podatności

CVE-2022-39206CRITICAL9.9ten sam produkt

Onedev is an open source, self-hosted Git Server with CI/CD and Kanban. When using Docker-based job executors,...

CVE-2022-39205CRITICAL9.0ten sam produkt

Onedev is an open source, self-hosted Git Server with CI/CD and Kanban. In versions of Onedev prior to 7.3.0 u...

CVE-2021-21245CRITICAL10.0ten sam produkt

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, AttachmentUploadServlet also saves us...

CVE-2021-21247CRITICAL9.6ten sam produkt

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, the application's BasePage registers ...

CVE-2021-21243CRITICAL10.0ten sam produkt

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, a Kubernetes REST endpoint exposes tw...