CVE-2024-45309highexplotación observadaCWE-200

CVE-2024-45309: fallo de gravedad alta en theonedev onedev

OneDev vulnerable to arbitrary file reading for unauthenticated user

Publicada el

Seguir esta CVE+ Monitorear onedev

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

63Vexday Risk Score

Corrige ahora. Ella explotación observada por VulnCheck y tiene exploit funcional público.

ssvc Actcvss 8.7epss 25%
de la publicación al armael mismo día
Publicada en NVD21 oct
metasploit19 oct
VulnCheck+572d
OneDev is a Git server with CI/CD, kanban, and packages. A vulnerability in versions prior to 11.0.9 allows unauthenticated users to read arbitrary files accessible by the OneDev server process. This issue has been fixed in version 11.0.9.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Productos afectados
theonedev · onedev
CVEs relacionadas — theonedev onedev

En el mismo producto, de las más peligrosas a las menos.

CVE-2021-21242CRITICALPre-Auth Unsafe Deserialization on AttachmentUploadServetEPSS 74.2%CVE-2021-21243CRITICALPre-Auth Unsafe Deserialization on KubernetesResourceEPSS 54.5%CVE-2021-21246HIGHPre-Auth Access token leakEPSS 49.1%CVE-2021-21251HIGHZipSlip Arbitrary File UploadEPSS 12.7%CVE-2021-21249CRITICALPost-Auth Unsafe Yaml deserializationEPSS 3.1%CVE-2022-39205CRITICALAccess Control Bypass in OnedevEPSS 2.5%