CVE-2021-21242

Katalog CVE

CVSS 9.8 · Critical EPSS 74,2%

Kerentanan Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') pada onedev project onedev. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is a critical vulnerability which can lead to pre-auth remote code execution. AttachmentUploadServlet deserializes untrusted data from the `Attachment-Support` header. This Servlet does not enforce any authentication or authorization checks. This issue may lead to pre-auth remote code execution. This issue was fixed in 4.0.3 by removing AttachmentUploadServlet and not using deserialization

Rincian

Terbit di NVD

15 Januari 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-502: Deserialization of Untrusted Data

EPSS (30 hari)

74,2% peluang dieksploitasi; lebih tinggi dari 99,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/theonedev/onedev/commit/f864053176c08f59ef2d97fea192ceca46a4d9be patch · advisory pihak ketiga
• https://github.com/theonedev/onedev/security/advisories/GHSA-5q3q-f373-2jv8 advisory pihak ketiga