PT-2023-19809 · Onedev · Onedev

Emilytrau + 1 · Publicado 2023-02-07 · Atualizado 2023-02-16 · CVE-2023-24828

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Onedev versions prior to 7.9.12

Description Onedev is a self-hosted Git Server with CI/CD and Kanban. The algorithm used to generate access token and password reset keys was not cryptographically secure in versions prior to 7.9.12. Existing normal users, or everyone if self-registration is allowed, may exploit this to elevate their privilege and obtain administrator permission.

Recommendations For versions prior to 7.9.12, upgrade to version 7.9.12 to address the issue. As a temporary workaround, consider restricting self-registration and closely monitoring user activities until the upgrade is applied. There are no known workarounds for this issue other than upgrading to the fixed version.

Exploit

Correção

Enumeração de Fraquezas

CWE-338

Identificadores relacionados

CVE-2023-24828

GHSA-JF5C-9R77-3J5J

Produtos afetados

Onedev

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/24xxx/CVE-2023-24828.json · Exploit
• https://github.com/theonedev/onedev/security/advisories/GHSA-jf5c-9r77-3j5j · Nota
• https://github.com/theonedev/onedev/commit/d67dd9686897fe5e4ab881d749464aa7c06a68e5 · Correção
• https://t.me/cvenotify/43848 · Publicação no Telegram
• https://t.me/cvenotify/44482 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-24828 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-24828 · Nota de Segurança
• https://t.me/cibsecurity/57735 · Publicação no Telegram