CVEvulnerability

CVE-2021-41112

8.1 HIGH Published 2022-02-28 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-02-28
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.1 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CVSS 3.1 ([email protected])
8.1 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CVSS 2.0 ([email protected])
5.5 MEDIUM — AV:N/AC:L/Au:S/C:N/I:P/A:P
Weaknesses
CWE-862

Description

Rundeck is an open source automation service with a web console, command line tools and a WebAPI. In versions prior to 3.4.5, authenticated users could craft a request to modify or delete System or Project level Calendars, without appropriate authorization. Modifying or removing calendars could cause Scheduled Jobs to execute, or not execute on desired calendar days. Severity depends on trust level of authenticated users and impact of running or not running scheduled jobs on days governed by calendar definitions. Version 3.4.5 contains a patch for this issue. There are currently no known workarounds.

Affected configurations

• pagerduty rundeck (< 3.4.5)

Related

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References