Vulnerabilities
Vulnerable Software

Vulnerability Details CVE-2023-24828

Onedev is a self-hosted Git Server with CI/CD and Kanban. In versions prior to 7.9.12 the algorithm used to generate access token and password reset keys was not cryptographically secure. Existing normal users (or everyone if it allows self-registration) may exploit this to elevate privilege to obtain administrator permission. This issue is has been addressed in version 7.9.12. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 26.5%
CVSS Severity
CVSS v3 Score 8.1
Products affected by CVE-2023-24828


Contact Us

Shodan ® - All rights reserved