CVE-2021-44659

Adding a new pipeline in GoCD server version 21.3.0 has a functionality that could be abused to do an un-intended action in order to achieve a Server Side Request Forgery (SSRF). NOTE: the vendor's position is that the observed behavior is not a vulnerability, because the product's design allows an admin to configure outbound requests

• CWE-918

• https://github.com/Mesh3l911/CVE-2021-44659Broken Link, Exploit, Third Party Advisory
• https://github.com/gocd/gocdProduct, Third Party Advisory
• https://www.gocd.org/Product, Vendor Advisory
• https://youtu.be/WW_a3znugl0Exploit, Third Party Advisory
• https://github.com/Mesh3l911/CVE-2021-44659Broken Link, Exploit, Third Party Advisory
• https://github.com/gocd/gocdProduct, Third Party Advisory
• https://www.gocd.org/Product, Vendor Advisory
• https://youtu.be/WW_a3znugl0Exploit, Third Party Advisory

Published

Dec 22, 2021

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-44650Zoho ManageEngine M365 Manager Plus before Build 4419 allows…7.2
• CVE-2021-44651Zoho ManageEngine CloudSecurityPlus before Build 4117 allows…8.8
• CVE-2021-44652Zoho ManageEngine O365 Manager Plus before Build 4416 allows…7.8
• CVE-2021-44653Online Magazine Management System 1.0 contains a SQL injecti…9.8
• CVE-2021-44655Online Pre-owned/Used Car Showroom Management System 1.0 con…9.8
• CVE-2021-44657In StackStorm versions prior to 3.6.0, the jinja interpreter…8.8
• CVE-2021-4466IPCop versions up to and including 2.1.9 contain an authenti…8.7
• CVE-2021-44662A Site Scripting (XSS) vulnerability exists in the Xerte Pro…6.1
• CVE-2021-44663A Remote Code Execution (RCE) vulnerability exists in the Xe…9.8
• CVE-2021-44664An Authenticated Remote Code Exection (RCE) vulnerability ex…8.8
• CVE-2021-44665A Directory Traversal vulnerability exists in the Xerte Proj…6.5
• CVE-2021-44667A Cross Site Scripting (XSS) vulnerability exists in Nacos 2…6.1