Vulnerability in Onedev_project Onedev
CVE-2023-24828
Onedev is a self-hosted Git Server with CI/CD and Kanban. In versions prior to 7.9.12 the algorithm used to generate access token and password reset keys was not cryptographically secure. Existing normal users (or everyone if it allows sel…
EPSS: 0.007 (49.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N.
Affected products
- Onedev_project Onedev
- Theonedev Onedev — versions < 7.9.12
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Third Party Advisory)
- security-advisories@github.com (Patch, Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2023-24828?
- CVE-2023-24828 is a high-severity vulnerability in Onedev_project Onedev, classified under Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG). CVSS score: 8.1/10. Published 2023-02-08.
- How severe is CVE-2023-24828?
- High severity. CVSS v3 base score is 8.1 out of 10.