CVE-2023-24828: falha de alta gravidade em theonedev onedev
Use of Cryptographically Weak Pseudo-Random Number Generator in Onedev
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.1epss 0.7%
Onedev is a self-hosted Git Server with CI/CD and Kanban. In versions prior to 7.9.12 the algorithm used to generate access token and password reset keys was not cryptographically secure. Existing normal users (or everyone if it allows self-registration) may exploit this to elevate privilege to obtain administrator permission. This issue is has been addressed in version 7.9.12. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Produtos afetados
theonedev · onedevCVEs relacionadas — theonedev onedev
No mesmo produto, das mais perigosas para as menos.
CVE-2021-21242CRITICALPre-Auth Unsafe Deserialization on AttachmentUploadServetEPSS 74.2%CVE-2021-21243CRITICALPre-Auth Unsafe Deserialization on KubernetesResourceEPSS 54.5%CVE-2021-21246HIGHPre-Auth Access token leakEPSS 49.1%CVE-2024-45309HIGHOneDev vulnerable to arbitrary file reading for unauthenticated userEPSS 24.5%CVE-2021-21251HIGHZipSlip Arbitrary File UploadEPSS 12.7%CVE-2021-21249CRITICALPost-Auth Unsafe Yaml deserializationEPSS 3.1%