Orkes Conductor Remote Code Execution Vulnerability
Vulnerability
A remote code execution vulnerability exists in Orkes Conductor version 3.21.11. This issue arises from unrestricted access to Java classes, allowing remote attackers to execute arbitrary operating system commands.
Impact
Exploitation of this vulnerability allows for remote code execution on the server where Conductor is running.
Reproduction
The vulnerability can be reproduced by sending a request that includes inline JavaScript, which is then executed by the Conductor server. This can be done through the Conductor UI or the REST API.
Added: Jun 30, 2025, 5:53 PM
Updated: Jun 30, 2025, 7:22 PM
Vulnerability Rating
Custom Algorithm
spread
0.0impact
10.0exploitability
8.7remediation
0.0relevance
0.2threat
6.4urgency
2.9incentive
5.8Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.