CVE-2021-21248

Katalog CVE

CVSS 8.8 · High EPSS 1,5%

Kerentanan Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') pada onedev project onedev. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is a critical vulnerability involving the build endpoint parameters. InputSpec is used to define parameters of a Build spec. It does so by using dynamically generated Groovy classes. A user able to control job parameters can run arbitrary code on OneDev's server by injecting arbitrary Groovy code. The ultimate result is in the injection of a static constructor that will run arbitrary code. For a full example refer to the referenced GHSA. This issue was addressed in 4.0.3 by escaping special characters such as quote from user input.

Rincian

Terbit di NVD

15 Januari 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

1,5% peluang dieksploitasi; lebih tinggi dari 73,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/theonedev/onedev/commit/39d95ab8122c5d9ed18e69dc024870cae08d2d60 patch · advisory pihak ketiga
• https://github.com/theonedev/onedev/security/advisories/GHSA-gwp4-5498-hv5f advisory pihak ketiga