PT-2024-3862 · Onenav · Onenav

Glzjin · Published 2024-01-05 · Updated 2024-05-17 · CVE-2023-7210

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions OneNav versions up to 0.9.33

Description A critical issue affects the API component of OneNav, specifically the /index.php?c=api file. The manipulation of the X-Token argument leads to improper authentication, allowing remote attacks. This issue may impact the confidentiality, integrity, and availability of protected information.

Recommendations For OneNav versions up to 0.9.33, consider disabling the API endpoint "/index.php?c=api" or restricting access to it until a fix is available. Additionally, avoid using the X-Token argument in the affected API endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BDU:2024-04260

CVE-2023-7210

GHSA-353Q-7H99-HF4X

Affected Products

Onenav

References · 14

• 🔥 https://note.zhaoj.in/share/eRbUygGMiJcp · Exploit
• https://osv.dev/vulnerability/CVE-2023-7210 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-04260 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-7210 · Security Note
• https://github.com/helloxz/onenav · Note
• https://vuldb.com/?id.249765 · Note
• https://vuldb.com/?ctiid.249765 · Note
• https://github.com/advisories/GHSA-353q-7h99-hf4x · Note
• https://doc.xiaoz.org/books/onenav/chapter/api · Note
• https://onenav.top · Note
• https://twitter.com/CVEnew/status/1743933603380081079 · Twitter Post
• https://doc.xiaoz.org/books/onenav/page/token · Note
• https://twitter.com/VulmonFeeds/status/1743956693136896510 · Twitter Post
• https://t.me/cvenotify/66515 · Telegram Post