CRITICAL🇵🇱 Wersja polska

CVE-2021-21242

CVSS 10.0v3.1pub. 2021-01-15upd. 2024-11-21

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is a critical vulnerability which can lead to pre-auth remote code execution. AttachmentUploadServlet deserializes untrusted data from the `Attachment-Support` header. This Servlet does not enforce any authentication or authorization checks. This issue may lead to pre-auth remote code execution. This issue was fixed in 4.0.3 by removing AttachmentUploadServlet and not using deserialization

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

  • Onedev Project Onedev

    APP
    Onedev Project
    < 4.0.3
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCEDeserialization
CWE
References

Related vulnerabilities

CVE-2022-39206CRITICAL9.9ten sam produkt

Onedev is an open source, self-hosted Git Server with CI/CD and Kanban. When using Docker-based job executors,...

CVE-2022-39205CRITICAL9.0ten sam produkt

Onedev is an open source, self-hosted Git Server with CI/CD and Kanban. In versions of Onedev prior to 7.3.0 u...

CVE-2021-21245CRITICAL10.0ten sam produkt

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, AttachmentUploadServlet also saves us...

CVE-2021-21247CRITICAL9.6ten sam produkt

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, the application's BasePage registers ...

CVE-2021-21244CRITICAL10.0ten sam produkt

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, There is a vulnerability that enabled...