Security Advisories
CVEs affecting projects tracked on Release Alert, from NVD & OSV.
CVE-2021-21244
10
CRITICALCVSS v3
Published
January 15, 2021
CVSS v2
7.5 HIGH
Affected
1 project
Assigned by
GitHub
Severity scale
010
Description
OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, There is a vulnerability that enabled pre-auth server side template injection via Bean validation message tampering. Full details in the reference GHSA. This issue was fixed in 4.0.3 by disabling validation interpolation completely.
GitHub