Vulnerabilities

TI-2024-30380 CVE-2024-45309

OneDev vulnerable to arbitrary file reading for unauthenticated user

MEDIUM 59

OneDev is a Git server with CI/CD, kanban, and packages.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.24531 Published 2024-10-21 Fixed in 11.0.9 CWE-200

TI-2023-10328 CVE-2023-24828

Use of Cryptographically Weak Pseudo-Random Number Generator in Onedev

MEDIUM 41

Onedev is a self-hosted Git Server with CI/CD and Kanban.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00713 Published 2023-02-07 Fixed in 7.9.12 CWE-338

TI-2022-17958 CVE-2022-38301 · GHSA-q2x9-c2ph-g22q

Onedev v7.4.14 contains a path traversal vulnerability which allows attackers to access…

MEDIUM 41

Onedev v7.4.14 contains a path traversal vulnerability which allows attackers to access restricted files and directories via uploading a crafted JAR file into the directory /opt/onedev/lib.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01462 Published 2022-09-14 No fix listed CWE-22

TI-2022-18585 CVE-2022-39206

CI/CD Docker Escape in OneDev

HIGH 76

Onedev is an open source, self-hosted Git Server with CI/CD and Kanban.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.02194 Published 2022-09-13 Fixed in 7.3.0 CWE-610

TI-2022-18586 CVE-2022-39207

Persistent XSS in OneDev

MEDIUM 58

Onedev is an open source, self-hosted Git Server with CI/CD and Kanban.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01029 Published 2022-09-13 Fixed in 7.3.0 CWE-79

TI-2022-18587 CVE-2022-39208

Git Repository Disclosure in Onedev

HIGH 72

Onedev is an open source, self-hosted Git Server with CI/CD and Kanban.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01935 Published 2022-09-13 Fixed in 7.3.0 CWE-552

TI-2022-18584 CVE-2022-39205

Access Control Bypass in Onedev

HIGH 76

Onedev is an open source, self-hosted Git Server with CI/CD and Kanban.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02461 Published 2022-09-13 Fixed in 7.3.0 CWE-287

TI-2021-12319 CVE-2021-32651 · GHSA-r89m-qpxm-ccgx

LDAP injection via OneDev may leak some LDAP directory information

LOW 22

OneDev is a development operations platform.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.01069 Published 2021-06-01 No fix listed CWE-90

TI-2021-04348 CVE-2021-21245