CVE-2021-21243 – OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, a Kubernetes REST …

Vuln ID: CVE-2021-21243

Published:  2021-01-15  20:15:12Z

Description: OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, a Kubernetes REST endpoint exposes two methods that deserialize untrusted data from the request body. These endpoints do not enforce any authentication or authorization checks.

This issue may lead to pre-auth RCE.

This issue was fixed in 4.0.3 by not using deserialization at KubernetesResource side.

Source: NVD.NIST.GOV

 

Date:

Categorie(s):

Tag(s):