CVE-2021-21250

MEDIUM EPSS 56.2%
Published Jan 15, 20215y ago · Modified Jun 17, 20262w ago
6.5 CVSS 3.1
Medium
Find Similar
Published Jan 15, 2021 5y ago
Last Modified Jun 17, 2026 2w ago

Description

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is a critical vulnerability which may lead to arbitrary file read. When BuildSpec is provided in XML format, the spec is processed by XmlBuildSpecMigrator.migrate(buildSpecString); which processes the XML document without preventing the expansion of external entities. These entities can be configured to read arbitrary files from the file system and dump their contents in the final XML document to be migrated. If the files are dumped in properties included in the YAML file, it will be possible for an attacker to read them. If not, it is possible for an attacker to exfiltrate the contents of these files Out Of Band. This issue was addressed in 4.0.3 by ignoring ENTITY instructions in xml file.

CVSS Details

Base Score
6.5
Exploitability
2.8
Impact
3.6
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality High
Integrity None
Availability None

Threat Intelligence

EPSS Exploit Probability
56.2% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-538

Affected Products 1

VendorProductVersionRange
onedev_projectonedev* <4.0.3

References 2

  • github.com https://github.com/theonedev/onedev/commit/9196fd795e87dab069b4260a3590a0ea886e770f
    PatchThird Party Advisory
  • github.com https://github.com/theonedev/onedev/security/advisories/GHSA-9pph-8gfc-6w2r
    Third Party Advisory

Remediation

  • github.com https://github.com/theonedev/onedev/commit/9196fd795e87dab069b4260a3590a0ea886e770f
    PatchThird Party Advisory