GHSA-3jmw-c69h-426c
Cross-Site Request Forgery (CSRF) can run untrusted code on Rundeck server
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.rundeck:rundeck-core | >= 3.4.0, < 3.4.3 | 3.4.3 |
| Maven | org.rundeck:rundeck-core | < 3.3.14 | 3.3.14 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
A user with `admin` access to the `system` resource type is potentially vulnerable to a CSRF attack that could cause the server to run untrusted code on all Rundeck editions.
### Patches
Available in Rundeck 3.4.3 and 3.3.14
### Workarounds
Please visit [https://rundeck.com/security](https://rundeck.com/security) for information about specific workarounds.
### For more information
If you have any questions or comments about this advisory:
* Email us at [[email protected]](mailto:[email protected])
To report security issues to Rundeck please use the form at [https://rundeck.com/security](https://rundeck.com/security)
References
External links from the advisory. They lead to third-party sites.