Use of Cryptographically Weak Pseudo-Random Number Generator in Onedev

CVE-2023-24828

What is CVE-2023-24828?

A vulnerability in OneDev, a self-hosted Git Server with CI/CD and Kanban features, allows normal users to exploit weak algorithms used for generating access tokens and password reset keys. Versions prior to 7.9.12 lack cryptographic security, enabling privilege escalation to gain administrator access. Users are strongly urged to upgrade to version 7.9.12 to mitigate this risk, as no workarounds are available.

References