by Kastro
Paper/Archive/CVE-2021-21244

CVE-2021-21244

theonedev onedev — Pre-Auth SSTI via Bean validation message tampering

EPSS 2%CVSS 10.0
critical.is priorityof 100
45
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 74.5.745 × 2014.9No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, There is a vulnerability that enabled pre-auth server side template injection via Bean validation message tampering. Full details in the reference GHSA. This issue was fixed in 4.0.3 by disabling validation interpolation completely.

Affected

ProductAffectedFixed inSource
onedev< 4.0.3–CNA

Scores by source

GitHub_M (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refgithub.com/theonedev/onedev/security/advisories/GHSA-vm26-xg39-cfj4refgithub.com/theonedev/onedev/commit/4f5dc6fb9e50f2c41c4929b0d8c5824b2cca3d65