Vulnerabilities > CVE-2023-24828 - Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) vulnerability in Onedev Project Onedev

CVSS 8.8 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

onedev-project

CWE-338

NVD

Published: 2023-02-08

Updated: 2023-02-16

Summary

Onedev is a self-hosted Git Server with CI/CD and Kanban. In versions prior to 7.9.12 the algorithm used to generate access token and password reset keys was not cryptographically secure. Existing normal users (or everyone if it allows self-registration) may exploit this to elevate privilege to obtain administrator permission. This issue is has been addressed in version 7.9.12. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Vulnerable Configurations

Part	Description	Count
Application	Onedev_Project Onedev Project Onedev 2.0.0 Onedev Project Onedev 2.0.1 Onedev Project Onedev 2.0.2 Onedev Project Onedev 2.0.3 Onedev Project Onedev 2.0.4 Onedev Project Onedev 2.0.5 Onedev Project Onedev 2.0.6 Onedev Project Onedev 2.0.7 Onedev Project Onedev 2.0.8 Onedev Project Onedev 3.0.4 Onedev Project Onedev 3.0.5 Onedev Project Onedev 3.0.6 Onedev Project Onedev 3.0.7 Onedev Project Onedev 3.0.8 Onedev Project Onedev 3.0.9 Onedev Project Onedev 3.0.10 Onedev Project Onedev 3.0.11 Onedev Project Onedev 3.0.12 Onedev Project Onedev 3.0.13 Onedev Project Onedev 3.0.14 Onedev Project Onedev 3.1.0 Onedev Project Onedev 3.1.1 Onedev Project Onedev 3.1.2 Onedev Project Onedev 3.2.0 Onedev Project Onedev 3.2.1 Onedev Project Onedev 3.2.2 Onedev Project Onedev 3.2.3 Onedev Project Onedev 3.2.4 Onedev Project Onedev 3.2.5 Onedev Project Onedev 3.2.6 Onedev Project Onedev 3.2.7 Onedev Project Onedev 3.2.8 Onedev Project Onedev 3.2.9 Onedev Project Onedev 4.0.0 Onedev Project Onedev 4.0.1 Onedev Project Onedev 4.0.2 Onedev Project Onedev 4.0.3 Onedev Project Onedev 4.0.4 Onedev Project Onedev 4.0.5 Onedev Project Onedev 4.0.6 Onedev Project Onedev 4.0.7 Onedev Project Onedev 4.0.8 Onedev Project Onedev 4.0.9 Onedev Project Onedev 4.1.0 Onedev Project Onedev 4.1.2 Onedev Project Onedev 4.1.3 Onedev Project Onedev 4.1.4 Onedev Project Onedev 4.1.5 Onedev Project Onedev 4.1.6 Onedev Project Onedev 4.2.0 Onedev Project Onedev 4.2.1 Onedev Project Onedev 4.2.2 Onedev Project Onedev 4.2.3 Onedev Project Onedev 4.2.4 Onedev Project Onedev 4.2.5 Onedev Project Onedev 4.3.0 Onedev Project Onedev 4.3.1 Onedev Project Onedev 4.3.2 Onedev Project Onedev 4.3.3 Onedev Project Onedev 4.3.4 Onedev Project Onedev 4.3.5 Onedev Project Onedev 4.4.0 Onedev Project Onedev 4.4.1 Onedev Project Onedev 4.4.2 Onedev Project Onedev 4.4.3 Onedev Project Onedev 4.5.0 Onedev Project Onedev 4.6.0 Onedev Project Onedev 4.6.1 Onedev Project Onedev 4.7.0 Onedev Project Onedev 4.8.0 Onedev Project Onedev 4.8.1 Onedev Project Onedev 4.9.0 Onedev Project Onedev 4.9.1 Onedev Project Onedev 4.9.2 Onedev Project Onedev 4.9.3 Onedev Project Onedev 4.9.4 Onedev Project Onedev 4.10.3 Onedev Project Onedev 4.11.0 Onedev Project Onedev 4.11.1 Onedev Project Onedev 5.0.0 Onedev Project Onedev 5.0.1 Onedev Project Onedev 5.1.0 Onedev Project Onedev 5.2.0 Onedev Project Onedev 5.2.1 Onedev Project Onedev 5.2.2 Onedev Project Onedev 5.3.0 Onedev Project Onedev 5.3.1 Onedev Project Onedev 5.3.2 Onedev Project Onedev 5.3.3 Onedev Project Onedev 5.4.0 Onedev Project Onedev 6.0.0 Onedev Project Onedev 6.1.0 Onedev Project Onedev 6.1.1 Onedev Project Onedev 6.1.2 Onedev Project Onedev 6.1.3 Onedev Project Onedev 6.1.4 Onedev Project Onedev 6.1.5 Onedev Project Onedev 6.2.0 Onedev Project Onedev 6.2.1 Onedev Project Onedev 6.2.2 Onedev Project Onedev 6.2.3 Onedev Project Onedev 6.2.4 Onedev Project Onedev 6.3.0 Onedev Project Onedev 6.3.1 Onedev Project Onedev 6.3.2 Onedev Project Onedev 6.3.3 Onedev Project Onedev 6.3.4 Onedev Project Onedev 6.3.5 Onedev Project Onedev 6.3.6 Onedev Project Onedev 6.3.7 Onedev Project Onedev 6.3.8 Onedev Project Onedev 6.3.9 Onedev Project Onedev 6.3.10 Onedev Project Onedev 6.3.11 Onedev Project Onedev 6.3.12 Onedev Project Onedev 6.3.13 Onedev Project Onedev 6.3.14 Onedev Project Onedev 6.3.15 Onedev Project Onedev 6.3.16 Onedev Project Onedev 6.3.17 Onedev Project Onedev 6.3.18 Onedev Project Onedev 6.3.19 Onedev Project Onedev 6.3.20 Onedev Project Onedev 6.3.21 Onedev Project Onedev 6.3.22 Onedev Project Onedev 6.3.23 Onedev Project Onedev 6.3.24 Onedev Project Onedev 6.3.25 Onedev Project Onedev 7.0.0 Onedev Project Onedev 7.0.1 Onedev Project Onedev 7.0.2 Onedev Project Onedev 7.0.3 Onedev Project Onedev 7.0.4 Onedev Project Onedev 7.0.5 Onedev Project Onedev 7.0.6 Onedev Project Onedev 7.0.7 Onedev Project Onedev 7.0.8 Onedev Project Onedev 7.0.9 Onedev Project Onedev 7.1.0 Onedev Project Onedev 7.1.1 Onedev Project Onedev 7.1.2 Onedev Project Onedev 7.1.3 Onedev Project Onedev 7.1.4 Onedev Project Onedev 7.1.5 Onedev Project Onedev 7.1.6 Onedev Project Onedev 7.1.7 Onedev Project Onedev 7.1.8 Onedev Project Onedev 7.2.0 Onedev Project Onedev 7.2.1 Onedev Project Onedev 7.2.2 Onedev Project Onedev 7.2.3 Onedev Project Onedev 7.2.4 Onedev Project Onedev 7.2.5 Onedev Project Onedev 7.2.7 Onedev Project Onedev 7.2.8 Onedev Project Onedev 7.2.9 Onedev Project Onedev 7.3.0 Onedev Project Onedev 7.3.2 Onedev Project Onedev 7.3.3 Onedev Project Onedev 7.3.4 Onedev Project Onedev 7.3.5 Onedev Project Onedev 7.3.6 Onedev Project Onedev 7.3.7 Onedev Project Onedev 7.3.8 Onedev Project Onedev 7.3.9 Onedev Project Onedev 7.3.10 Onedev Project Onedev 7.3.11 Onedev Project Onedev 7.3.12 Onedev Project Onedev 7.3.13 Onedev Project Onedev 7.3.14 Onedev Project Onedev 7.3.15 Onedev Project Onedev 7.4.0 Onedev Project Onedev 7.4.1 Onedev Project Onedev 7.4.2 Onedev Project Onedev 7.4.3 Onedev Project Onedev 7.4.5 Onedev Project Onedev 7.4.6 Onedev Project Onedev 7.4.7 Onedev Project Onedev 7.4.8 Onedev Project Onedev 7.4.9 Onedev Project Onedev 7.4.10 Onedev Project Onedev 7.4.11 Onedev Project Onedev 7.4.12 Onedev Project Onedev 7.4.13 Onedev Project Onedev 7.4.14 Onedev Project Onedev 7.4.15 Onedev Project Onedev 7.4.16 Onedev Project Onedev 7.4.17 Onedev Project Onedev 7.4.18 Onedev Project Onedev 7.4.19 Onedev Project Onedev 7.4.20 Onedev Project Onedev 7.4.21 Onedev Project Onedev 7.4.22 Onedev Project Onedev 7.4.23 Onedev Project Onedev 7.4.24 Onedev Project Onedev 7.4.25 Onedev Project Onedev 7.4.26 Onedev Project Onedev 7.4.27 Onedev Project Onedev 7.4.28 Onedev Project Onedev 7.4.29 Onedev Project Onedev 7.5.0 Onedev Project Onedev 7.5.1 Onedev Project Onedev 7.5.2 Onedev Project Onedev 7.5.3 Onedev Project Onedev 7.6.0 Onedev Project Onedev 7.6.1 Onedev Project Onedev 7.6.2 Onedev Project Onedev 7.7.0 Onedev Project Onedev 7.7.1 Onedev Project Onedev 7.7.2 Onedev Project Onedev 7.7.4 Onedev Project Onedev 7.7.5 Onedev Project Onedev 7.7.6 Onedev Project Onedev 7.7.7 Onedev Project Onedev 7.7.8 Onedev Project Onedev 7.7.9 Onedev Project Onedev 7.7.10 Onedev Project Onedev 7.7.11 Onedev Project Onedev 7.7.12 Onedev Project Onedev 7.7.13 Onedev Project Onedev 7.7.14 Onedev Project Onedev 7.7.15 Onedev Project Onedev 7.8.0 Onedev Project Onedev 7.8.1 Onedev Project Onedev 7.8.2 Onedev Project Onedev 7.8.3 Onedev Project Onedev 7.8.4 Onedev Project Onedev 7.8.5 Onedev Project Onedev 7.8.6 Onedev Project Onedev 7.8.7 Onedev Project Onedev 7.8.8 Onedev Project Onedev 7.8.9 Onedev Project Onedev 7.8.10 Onedev Project Onedev 7.8.11 Onedev Project Onedev 7.8.12 Onedev Project Onedev 7.8.13 Onedev Project Onedev 7.8.14 Onedev Project Onedev 7.8.15 Onedev Project Onedev 7.8.16 Onedev Project Onedev 7.9.0 Onedev Project Onedev 7.9.1 Onedev Project Onedev 7.9.2 Onedev Project Onedev 7.9.3 Onedev Project Onedev 7.9.4 Onedev Project Onedev 7.9.5 Onedev Project Onedev 7.9.6 Onedev Project Onedev 7.9.7 Onedev Project Onedev 7.9.8 Onedev Project Onedev 7.9.9 Onedev Project Onedev 7.9.10 Onedev Project Onedev 7.9.11	254

Common Weakness Enumeration (CWE)

CWE-338 - Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References