Lucene search
GoogleOSV:CVE-2021-21243HistoryJan 15, 2021 - 8:15 p.m.
CVE-2021-21243
2021-01-1520:15:12
Google
osv.dev
2
onedev
kubernetes
vulnerability
fix
rest endpoint
rce
deserialization
authentication
authorization
OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, a Kubernetes REST endpoint exposes two methods that deserialize untrusted data from the request body. These endpoints do not enforce any authentication or authorization checks. This issue may lead to pre-auth RCE. This issue was fixed in 4.0.3 by not using deserialization at KubernetesResource side.
Related
cvelist
cvelist
CVE-2021-21243 Pre-Auth Unsafe Deserialization on KubernetesResource
2021-01-15 20:05:21
nvd
nvd
CVE-2021-21243
2021-01-15 20:15:12
cve
cve
CVE-2021-21243
2021-01-15 20:15:12
prion
prion
Authorization
2021-01-15 20:15:00