Is CVE-2021-21247 actively exploited?

No active exploitation of CVE-2021-21247 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2021-21247 be exploited remotely?

Yes. CVE-2021-21247 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2021-21247?

CVE-2021-21247 has a CVSS score of 8.8 (HIGH).

HOME VULNERABILITIESCVE-2021-21247

HIGH

CVE-2021-21247

CWE-74Published: January 15, 2021· Updated: Jun 17, 2026

8.8

CVSS v3.1

Official Description

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, the application's BasePage registers an AJAX event listener (`AbstractPostAjaxBehavior`) in all pages other than the login page. This listener decodes and deserializes the `data` query parameter. We can access this listener by submitting a POST request to any page. This issue may lead to `post-auth RCE` This endpoint is subject to authentication and, therefore, requires a valid user to carry on the attack. This issue was addressed in 4.0.3 by encrypting serialization payload with secrets only known to server.

NVD Source

Technical Analysis

CVE-2021-21247 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 8.8.