CVE-2023-24828: onedev project onedev

csirt@kutim:~/threat-intel/cve/CVE-2023-24828

CVSS 8.8 · High EPSS 0,71%

Kerentanan Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) pada onedev project onedev. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

Onedev is a self-hosted Git Server with CI/CD and Kanban. In versions prior to 7.9.12 the algorithm used to generate access token and password reset keys was not cryptographically secure. Existing normal users (or everyone if it allows self-registration) may exploit this to elevate privilege to obtain administrator permission. This issue is has been addressed in version 7.9.12. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Rincian

Terbit di NVD: 8 Februari 2023
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
EPSS (30 hari): 0,71% peluang dieksploitasi; lebih tinggi dari 52,4% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
onedev project	onedev	Semua versi sebelum 7.9.12

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/theonedev/onedev/commit/d67dd9686897fe5e4ab881d749464aa7c06a68e5 patch · advisory pihak ketiga
https://github.com/theonedev/onedev/security/advisories/GHSA-jf5c-9r77-3j5j advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.