vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2021-25924

HIGH
8.8
CVSS Score
Published: April 1, 2021 at 05:58 PM UTC
Updated: June 17, 2026 at 03:42 AM UTC
1 product affected across 1 vendorGocd

Using gocd by N/A?

Get instant alerts when new vulnerabilities affect gocd - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH8.8
Exploit prediction
EPSS 0.8%

Description

In GoCD, versions 19.6.0 to 21.1.0 are vulnerable to Cross-Site Request Forgery due to missing CSRF protection at the `/go/api/config/backup` endpoint. An attacker can trick a victim to click on a malicious link which could change backup configurations or execute system commands in the post_backup_script field.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Gocd· Thoughtworks
95%
19.6.0 ≤ v < 21.2.019.10.019.11.019.12.019.6.019.7.019.8.019.9.020.1.020.10.020.2.020.3.020.4.020.5.020.6.020.7.020.8.020.9.021.1.0
Affected range stops below 21.2.0, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (2)

x_refsource_MISCPatchThird Party Advisory
Source: [email protected]
https://github.com/gocd/gocd/commit/7d0baab0d361c377af84994f95ba76c280048548
x_refsource_MISC
Source: [email protected]
https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25924%2C

CVSS

8.8HIGH[email protected]
Attack Vector
NETWORK
Complexity
LOW
Privileges
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-352

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card