CVE-2021-21245: onedev project onedev

csirt@kutim:~/threat-intel/cve/CVE-2021-21245

CVSS 9.8 · Critical EPSS 1,2%

Kerentanan Unrestricted Upload of File with Dangerous Type pada onedev project onedev. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, AttachmentUploadServlet also saves user controlled data (`request.getInputStream()`) to a user specified location (`request.getHeader("File-Name")`). This issue may lead to arbitrary file upload which can be used to upload a WebShell to OneDev server. This issue is addressed in 4.0.3 by only allowing uploaded file to be in attachments folder. The webshell issue is not possible as OneDev never executes files in attachments folder.

Rincian

Terbit di NVD: 15 Januari 2021
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-434: Unrestricted Upload of File with Dangerous Type
EPSS (30 hari): 1,2% peluang dieksploitasi; lebih tinggi dari 67,7% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
onedev project	onedev	Semua versi sebelum 4.0.3

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/theonedev/onedev/commit/0c060153fb97c0288a1917efdb17cc426934dacb patch · advisory pihak ketiga
https://github.com/theonedev/onedev/security/advisories/GHSA-62m2-38q5-96w9 advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.