CVE-2023-24828

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Onedev is a self-hosted Git Server with CI/CD and Kanban. In versions prior to 7.9.12 the algorithm used to generate access token and password reset keys was not cryptographically secure. Existing normal users (or everyone if it allows self-registration) may exploit this to elevate privilege to obtain administrator permission. This issue is has been addressed in version 7.9.12. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-338

Affected software

No affected versions have been published.

Timeline

Published: Feb 8, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-248298.8Incorrect Authorization vulnerability in Apache Software Foundation Apache IoTDB.This issue affects the iotdb-web-workbench component from 0 CVE-2023-248307.5Improper Authentication vulnerability in Apache Software Foundation Apache IoTDB.This issue affects iotdb-web-workbench component: from 0.13 CVE-2023-248319.8Improper Authentication vulnerability in Apache Software Foundation Apache IoTDB.This issue affects Apache IoTDB Grafana Connector: from 0.1 CVE-2023-248327.5A null pointer dereference bug in Hermes prior to commit 5cae9f72975cf0e5a62b27fdd8b01f103e198708 could have been used by an attacker to cra CVE-2023-248337.5A use-after-free in BigIntPrimitive addition in Hermes prior to commit a6dcafe6ded8e61658b40f5699878cd19a481f80 could have been used by an a CVE-2023-248346.5WisdomGarden Tronclass has improper access control when uploading file. An authenticated remote attacker with general user privilege can exp CVE-2023-248357.2Softnext Technologies Corp.’s SPAM SQR has a vulnerability of Code Injection within its specific function. An authenticated remote attacker CVE-2023-248368.8SUNNET CTMS has vulnerability of path traversal within its file uploading function. An authenticated remote attacker with general user privi CVE-2023-248378.8HGiga PowerStation remote management function has insufficient filtering for user input. An authenticated remote attacker with general user CVE-2023-248389.8HGiga PowerStation has a vulnerability of Information Leakage. An unauthenticated remote attacker can exploit this vulnerability to obtain t CVE-2023-248396.1HGiga MailSherlock’s specific function has insufficient filtering for user input. An unauthenticated remote attacker can exploit this vulner CVE-2023-24844.9The Active Directory Integration plugin for WordPress is vulnerable to time-based SQL Injection via the orderby and order parameters in vers