Lucene search

GitHub_MCVE-2021-21244

HistoryJan 15, 2021 - 8:15 p.m.

CVE-2021-21244

2021-01-1520:15:12

CWE-74

CWE-94

GitHub_M

web.nvd.nist.gov

onedev

devops platform

cve-2021-21244

server side template injection

security vulnerability

nvd

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

AI Score

9.5

Confidence

High

EPSS

0.003

Percentile

70.2%

JSON

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, There is a vulnerability that enabled pre-auth server side template injection via Bean validation message tampering. Full details in the reference GHSA. This issue was fixed in 4.0.3 by disabling validation interpolation completely.

Affected configurations

Nvd

Vulners

Node

onedev_projectonedevRange<4.0.3

VendorProductVersionCPE
onedev_projectonedev*cpe:2.3:a:onedev_project:onedev:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
onedev_project	onedev	*	cpe:2.3:a:onedev_project:onedev::::::::

CNA Affected

[
  {
    "product": "onedev",
    "vendor": "theonedev",
    "versions": [
      {
        "status": "affected",
        "version": "< 4.0.3"
      }
    ]
  }
]

References

github.com/theonedev/onedev/commit/4f5dc6fb9e50f2c41c4929b0d8c5824b2cca3d65

github.com/theonedev/onedev/security/advisories/GHSA-vm26-xg39-cfj4

Social References

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

AI Score

9.5

Confidence

High

EPSS

0.003

Percentile

70.2%

JSON

Related for CVE-2021-21244