CVE-2023-24828 - CVE House
Back to Database
Status published High CVE-2023-24828

Use of Cryptographically Weak Pseudo-Random Number Generator in Onedev

Vulnerability Description

Onedev is a self-hosted Git Server with CI/CD and Kanban. In versions prior to 7.9.12 the algorithm used to generate access token and password reset keys was not cryptographically secure. Existing normal users (or everyone if it allows self-registration) may exploit this to elevate privilege to obtain administrator permission. This issue is has been addressed in version 7.9.12. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-24828

Credits & Attribution

No credits recorded in the NVD database.

References

More from theonedev

View All →
CVE-2024-45309
OneDev vulnerable to arbitrary file reading for unauthenticated user
High 8.7
CVE-2022-39208
Git Repository Disclosure in Onedev
High 7.5
CVE-2022-39207
Persistent XSS in OneDev
Medium 5.4
CVE-2022-39206
CI/CD Docker Escape in OneDev
Critical 9.9
CVE-2022-39205
Access Control Bypass in Onedev
Critical 9

Affected Vendor

Affected Software

onedev
Vulnerable Versions:
< 7.9.12

Timeline

Official Publish: February 7th, 2023
Last Modified: March 10th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weaknesses (CWE)

CWE-338

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.