CVE-2021-21246: fallo de gravedad alta en theonedev onedev
Pre-Auth Access token leak
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
48Vexday Risk Score
Corrige pronto. Ella tiene exploit funcional público.
ssvc Attendcvss 8.6epss 49%
OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, the REST UserResource endpoint performs a security check to make sure that only administrators can list user details. However for the `/users/{id}` endpoint there are no security checks enforced so it is possible to retrieve arbitrary user details including their Access Tokens! These access tokens can be used to access the API or clone code in the build spec via the HTTP(S) protocol. It has permissions to all projects accessible by the user account. This issue may lead to `Sensitive data leak` and leak the Access Token which can be used to impersonate the administrator or any other users. This issue was addressed in 4.0.3 by removing user info from restful api.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Productos afectados
theonedev · onedevCVEs relacionadas — theonedev onedev
En el mismo producto, de las más peligrosas a las menos.
CVE-2021-21242CRITICALPre-Auth Unsafe Deserialization on AttachmentUploadServetEPSS 74.2%CVE-2021-21243CRITICALPre-Auth Unsafe Deserialization on KubernetesResourceEPSS 54.5%CVE-2024-45309HIGHOneDev vulnerable to arbitrary file reading for unauthenticated userEPSS 24.5%CVE-2021-21251HIGHZipSlip Arbitrary File UploadEPSS 12.7%CVE-2021-21249CRITICALPost-Auth Unsafe Yaml deserializationEPSS 3.1%CVE-2022-39205CRITICALAccess Control Bypass in OnedevEPSS 2.5%