CVE-2023-24828
Assigner: GitHub_M
Published: 2023-02-07T23:25:11.397Z
State: PUBLISHED
title: Use of Cryptographically Weak Pseudo-Random Number Generator in Onedev
problemTypes: descriptions: cweId: CWE-338
description: CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
type: CWE
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
version: 3.1
affected: vendor: theonedev
product: onedev
versions: version: < 7.9.12
status: affected
descriptions: value: Onedev is a self-hosted Git Server with CI/CD and Kanban. In versions prior to 7.9.12 the algorithm used to generate access token and password reset keys was not cryptographically secure. Existing normal users (or everyone if it allows self-registration) may exploit this to elevate privilege to obtain administrator permission. This issue is has been addressed in version 7.9.12. Users are advised to upgrade. There are no known workarounds for this vulnerability.
source: advisory: GHSA-jf5c-9r77-3j5j
discovery: UNKNOWN