Description
Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to version 3.3.14 and version 3.4.3, a user with `admin` access to the `system` resource type is potentially vulnerable to a CSRF attack that could cause the server to run untrusted code on all Rundeck editions. Patches are available in Rundeck versions 3.4.3 and 3.3.14.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| rundeck | rundeck | < 3.3.14, >= 3.4.0, < 3.4.3 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.rundeck:rundeck-core | >= 3.4.0, < 3.4.3 | 3.4.3 | GHSA-3jmw-c69h-426c |
| Maven | org.rundeck:rundeck-core | < 3.3.14 | 3.3.14 | GHSA-3jmw-c69h-426c |