What’s Vulnerable › Vulnerabilities

CVE-2021-44659

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-12-22 · updated 2026-06-17
• Weakness: CWE-918

Description

Adding a new pipeline in GoCD server version 21.3.0 has a functionality that could be abused to do an un-intended action in order to achieve a Server Side Request Forgery (SSRF). NOTE: the vendor's position is that the observed behavior is not a vulnerability, because the product's design allows an admin to configure outbound requests

Affected products

• gocd: 21.3.0

References

• https://github.com/Mesh3l911/CVE-2021-44659
• https://github.com/gocd/gocd
• https://www.gocd.org/
• https://youtu.be/WW_a3znugl0
• https://github.com/Mesh3l911/CVE-2021-44659
• https://github.com/gocd/gocd
• https://www.gocd.org/
• https://youtu.be/WW_a3znugl0

Get alerted when CVE-2021-44659 or the next vulnerability affects your stack