CVE-2021-41111

Impact: Moderate

Affected Versions: < 3.4.5, < 3.3.15

Patched Versions: 3.4.5+, 3.3.15+

Impact

An authenticated user with authorization to read webhooks in one project, can craft a request to reveal Webhook definitions and tokens in another project. The user could use the revealed webhook tokens to trigger webhooks.

Severity depends on trust level of authenticated users, and whether any webhooks exist that trigger sensitive actions.

Patches

Patched in release 3.4.5+, 3.3.15+

Workarounds

None

For more information
If you have any questions or comments about this advisory:

Email us at security@rundeck.com
To report security issues to Rundeck please use the form at http://rundeck.com/security