| Package | Affected versions | Patched versions |
|---|---|---|
| org.rundeck:rundeck-core | ≥ 3.4.0, < 3.4.3< 3.3.14 | 3.4.33.3.14 |
| rundeck | ≥ 3.4.0, < 3.4.3< 3.3.14 | 3.4.33.3.14 |
A user with admin access to the system resource type is potentially vulnerable to a CSRF attack that could cause the server to run untrusted code on all Rundeck editions.
Available in Rundeck 3.4.3 and 3.3.14
Please visit https://rundeck.com/security for information about specific workarounds.
If you have any questions or comments about this advisory:
To report security issues to Rundeck please use the form at https://rundeck.com/security
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free