CVE-2023-24828CWE-338

Use of Cryptographically Weak Pseudo-Random Number Generator in Onedev

High · published February 7, 2023

CVSS v3.1
8.1
EPSS
1%
Percentile
53.1
In the wild
Unconfirmed
What it is

Onedev is a self-hosted Git Server with CI/CD and Kanban. In versions prior to 7.9.12 the algorithm used to generate access token and password reset keys was not cryptographically secure. Existing normal users (or everyone if it allows self-registration) may exploit this to elevate privilege to obtain administrator permission. This issue is has been addressed in version 7.9.12. Users are advised to upgrade. There are no known workarounds for this vulnerability.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00713 · 53.1th percentile
Weakness
CWE-338 · Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Published
2023-02-07T23:25Z
EPSS history
Timeline
  • 07 FEB 23:25Z
    Use of Cryptographically Weak Pseudo-Random Number Generator in Onedev
    cvelistv5