Vulnerabilities > CVE-2021-39132 - Deserialization of Untrusted Data vulnerability in Pagerduty Rundeck

CVSS 8.8 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

pagerduty

CWE-502

NVD

Published: 2021-08-30

Updated: 2024-11-21

Summary

Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to version 3.3.14 and version 3.4.3, an authorized user can upload a zip-format plugin with a crafted plugin.yaml, or a crafted aclpolicy yaml file, or upload an untrusted project archive with a crafted aclpolicy yaml file, that can cause the server to run untrusted code on Rundeck Community or Enterprise Edition. An authenticated user can make a POST request, that can cause the server to run untrusted code on Rundeck Enterprise Edition. The zip-format plugin issues requires authentication and authorization to these access levels, and affects all Rundeck editions:`admin` level access to the `system` resource type. The ACL Policy yaml file upload issues requires authentication and authorization to these access levels, and affects all Rundeck editions: `create` `update` or `admin` level access to a `project_acl` resource, and/or`create` `update` or `admin` level access to the `system_acl` resource. The unauthorized POST request requires authentication, but no specific authorization, and affects Rundeck Enterprise only. Patches are available in versions 3.4.3, 3.3.14

Vulnerable Configurations

Part	Description	Count
Application	Pagerduty Pagerduty Rundeck 1.0 Pagerduty Rundeck 1.1 Pagerduty Rundeck 1.1.1 Pagerduty Rundeck 1.2 Pagerduty Rundeck 1.2.1 Pagerduty Rundeck 1.3 Pagerduty Rundeck 1.3.1 Pagerduty Rundeck 1.3.2 Pagerduty Rundeck 1.4 Pagerduty Rundeck 1.4.0 Pagerduty Rundeck 1.4.0.1 Pagerduty Rundeck 1.4.0.2 Pagerduty Rundeck 1.4.1 Pagerduty Rundeck 1.4.2 Pagerduty Rundeck 1.4.2.1 Pagerduty Rundeck 1.4.3 Pagerduty Rundeck 1.4.4 Pagerduty Rundeck 1.4.5 Pagerduty Rundeck 1.5 Pagerduty Rundeck 1.5-01 Pagerduty Rundeck 1.5-02 Pagerduty Rundeck 1.5-03 Pagerduty Rundeck 1.5.1 Pagerduty Rundeck 1.5.2 Pagerduty Rundeck 1.5.3 Pagerduty Rundeck 1.6.0 Pagerduty Rundeck 1.6.1 Pagerduty Rundeck 1.6.2 Pagerduty Rundeck 2.0.0 Pagerduty Rundeck 2.0.1 Pagerduty Rundeck 2.0.2 Pagerduty Rundeck 2.0.3 Pagerduty Rundeck 2.0.4 Pagerduty Rundeck 2.1.0 Pagerduty Rundeck 2.1.1 Pagerduty Rundeck 2.1.2 Pagerduty Rundeck 2.1.3 Pagerduty Rundeck 2.2.0 Pagerduty Rundeck 2.2.1 Pagerduty Rundeck 2.2.2 Pagerduty Rundeck 2.2.3 Pagerduty Rundeck 2.3.0 Pagerduty Rundeck 2.3.1 Pagerduty Rundeck 2.3.2 Pagerduty Rundeck 2.4.0 Pagerduty Rundeck 2.4.1 Pagerduty Rundeck 2.4.2 Pagerduty Rundeck 2.5.0 Pagerduty Rundeck 2.5.1 Pagerduty Rundeck 2.5.2 Pagerduty Rundeck 2.5.3 Pagerduty Rundeck 2.6.0 Pagerduty Rundeck 2.6.1 Pagerduty Rundeck 2.6.2 Pagerduty Rundeck 2.6.3 Pagerduty Rundeck 2.6.4 Pagerduty Rundeck 2.6.5 Pagerduty Rundeck 2.6.6 Pagerduty Rundeck 2.6.7 Pagerduty Rundeck 2.6.8 Pagerduty Rundeck 2.6.9 Pagerduty Rundeck 2.6.10 Pagerduty Rundeck 2.6.11 Pagerduty Rundeck 2.7.0 Pagerduty Rundeck 2.7.1 Pagerduty Rundeck 2.7.2 Pagerduty Rundeck 2.7.3 Pagerduty Rundeck 2.8.0 Pagerduty Rundeck 2.8.1 Pagerduty Rundeck 2.8.2 Pagerduty Rundeck 2.8.3 Pagerduty Rundeck 2.8.4 Pagerduty Rundeck 2.9.0 Pagerduty Rundeck 2.9.1 Pagerduty Rundeck 2.9.2 Pagerduty Rundeck 2.9.3 Pagerduty Rundeck 2.9.4 Pagerduty Rundeck 2.10.0 Pagerduty Rundeck 2.10.1 Pagerduty Rundeck 2.10.2 Pagerduty Rundeck 2.10.3 Pagerduty Rundeck 2.10.4 Pagerduty Rundeck 2.10.5 Pagerduty Rundeck 2.10.6 Pagerduty Rundeck 2.10.7 Pagerduty Rundeck 2.10.8 Pagerduty Rundeck 2.11.0 Pagerduty Rundeck 2.11.1 Pagerduty Rundeck 2.11.2 Pagerduty Rundeck 2.11.3 Pagerduty Rundeck 2.11.4 Pagerduty Rundeck 2.11.5 Pagerduty Rundeck 2.11.6 Pagerduty Rundeck 2.11.7 Pagerduty Rundeck 2.11.8 Pagerduty Rundeck 2.11.9 Pagerduty Rundeck 3.0.0 Pagerduty Rundeck 3.0.1 Pagerduty Rundeck 3.0.2 Pagerduty Rundeck 3.0.3 Pagerduty Rundeck 3.0.4 Pagerduty Rundeck 3.0.5 Pagerduty Rundeck 3.0.6 Pagerduty Rundeck 3.0.7 Pagerduty Rundeck 3.0.8 Pagerduty Rundeck 3.0.9 Pagerduty Rundeck 3.0.10 Pagerduty Rundeck 3.0.11 Pagerduty Rundeck 3.0.12 Pagerduty Rundeck 3.0.13 Pagerduty Rundeck 3.0.14 Pagerduty Rundeck 3.0.15 Pagerduty Rundeck 3.0.16 Pagerduty Rundeck 3.0.17 Pagerduty Rundeck 3.0.19 Pagerduty Rundeck 3.0.20 Pagerduty Rundeck 3.0.21 Pagerduty Rundeck 3.0.22 Pagerduty Rundeck 3.0.23 Pagerduty Rundeck 3.0.24 Pagerduty Rundeck 3.1.0 Pagerduty Rundeck 3.1.2 Pagerduty Rundeck 3.1.3 Pagerduty Rundeck 3.2.0 Pagerduty Rundeck 3.2.1 Pagerduty Rundeck 3.2.2 Pagerduty Rundeck 3.2.3 Pagerduty Rundeck 3.2.4 Pagerduty Rundeck 3.2.5 Pagerduty Rundeck 3.2.6 Pagerduty Rundeck 3.2.7 Pagerduty Rundeck 3.2.8 Pagerduty Rundeck 3.2.9 Pagerduty Rundeck 3.3.0 Pagerduty Rundeck 3.3.1 Pagerduty Rundeck 3.3.2 Pagerduty Rundeck 3.3.3 Pagerduty Rundeck 3.3.4 Pagerduty Rundeck 3.3.5 Pagerduty Rundeck 3.3.6 Pagerduty Rundeck 3.3.7 Pagerduty Rundeck 3.3.8 Pagerduty Rundeck 3.3.9 Pagerduty Rundeck 3.3.10 Pagerduty Rundeck 3.3.11 Pagerduty Rundeck 3.3.12 Pagerduty Rundeck 3.3.13 Pagerduty Rundeck 3.4.0 Pagerduty Rundeck 3.4.1 Pagerduty Rundeck 3.4.2 Pagerduty Rundeck -	222

Common Weakness Enumeration (CWE)

CWE-502 - Deserialization of Untrusted Data

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References