2 lines
3.7 KiB
JSON
2 lines
3.7 KiB
JSON
{"affected":[{"affectedData":[{"product":"onedev","vendor":"theonedev","versions":[{"status":"affected","version":"< 4.0.3"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:onedev_project:onedev:*:*:*:*:*:*:*:*","matchCriteriaId":"5287F01C-3A77-4491-AB49-401A50FAA6E9","versionEndExcluding":"4.0.3","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, There is a vulnerability that enabled pre-auth server side template injection via Bean validation message tampering. Full details in the reference GHSA. This issue was fixed in 4.0.3 by disabling validation interpolation completely."},{"lang":"es","value":"OneDev es una plataforma devops todo en uno. En OneDev versiones anteriores a 4.0.3. Se presenta una vulnerabilidad que habilita una inyección de plantilla del lado del servidor previa a la autenticación por medio de la manipulación del mensaje de comprobación de Bean. Detalles completos en la referencia GHSA. Este problema se corrigió en la versión 4.0.3 al deshabilitar la interpolación de comprobación por completo"}],"id":"CVE-2021-21244","lastModified":"2026-06-17T03:35:07.030","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"HIGH","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"NONE","availabilityImpact":"PARTIAL","baseScore":7.5,"confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","version":"2.0"},"exploitabilityScore":10.0,"impactScore":6.4,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"nvd@nist.gov","type":"Primary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":10.0,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.8,"source":"security-advisories@github.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2021-01-15T20:15:12.097","references":[{"source":"security-advisories@github.com","tags":["Patch","Third Party Advisory"],"url":"https://github.com/theonedev/onedev/commit/4f5dc6fb9e50f2c41c4929b0d8c5824b2cca3d65"},{"source":"security-advisories@github.com","tags":["Third Party Advisory"],"url":"https://github.com/theonedev/onedev/security/advisories/GHSA-vm26-xg39-cfj4"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"],"url":"https://github.com/theonedev/onedev/commit/4f5dc6fb9e50f2c41c4929b0d8c5824b2cca3d65"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"url":"https://github.com/theonedev/onedev/security/advisories/GHSA-vm26-xg39-cfj4"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-74"}],"source":"security-advisories@github.com","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-94"}],"source":"nvd@nist.gov","type":"Primary"}]}
|