{"id":"CVE-2023-24828","summary":"Use of Cryptographically Weak Pseudo-Random Number Generator in Onedev","details":"Onedev is a self-hosted Git Server with CI/CD and Kanban. In versions prior to 7.9.12 the algorithm used to generate access token and password reset keys was not cryptographically secure. Existing normal users (or everyone if it allows self-registration) may exploit this to elevate privilege to obtain administrator permission. This issue is has been addressed in version 7.9.12. Users are advised to upgrade. There are no known workarounds for this vulnerability.","aliases":["GHSA-jf5c-9r77-3j5j"],"modified":"2026-08-12T13:32:29.163062Z","published":"2023-02-07T23:25:11.397Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-338"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/24xxx/CVE-2023-24828.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/24xxx/CVE-2023-24828.json"},{"type":"ADVISORY","url":"https://github.com/theonedev/onedev/security/advisories/GHSA-jf5c-9r77-3j5j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-24828"},{"type":"FIX","url":"https://github.com/theonedev/onedev/commit/d67dd9686897fe5e4ab881d749464aa7c06a68e5"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/theonedev/onedev","events":[{"introduced":"0"},{"fixed":"c1a168bfb4250b4c38f16a876c758ccacf8830e6"},{"fixed":"d67dd9686897fe5e4ab881d749464aa7c06a68e5"}],"database_specific":{"cpe":"cpe:2.3:a:onedev_project:onedev:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"7.9.12"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["v7.9.11","v7.9.10","v7.9.9","v7.9.8","v7.9.7","v7.9.6","v7.9.5","v7.9.4","v7.9.3","v7.9.2","v7.9.1","v7.9.0","v7.8.15","v7.8.14","v7.8.13","v7.8.12","v7.8.11","v7.8.10","v7.8.9","v7.8.8","v7.8.7","v7.8.6","v7.8.5","v7.8.4","v7.8.3","v7.8.2","v7.8.1","v7.8.0","v7.7.14","v7.7.13","v7.7.12","v7.7.5","v7.7.2","v7.7.1","v7.6.2","v7.6.1","v7.6.0","v7.5.3","v7.5.2","v7.5.1","v7.5.0","v7.4.29","v7.4.28","v7.4.27","v7.4.26","v7.4.25","v7.4.24","v7.4.23","v7.4.22","v7.4.21","v7.4.20","v7.4.19","v7.4.18","v7.4.17","v7.4.16","v7.4.15","v7.4.14","v7.4.13","v7.4.12","v7.4.11","v7.4.10","v7.4.9","v7.4.8","v7.4.7","v7.4.3","v7.4.2","v7.4.1","v7.4.0","v7.3.15","v7.3.14","v7.3.13","v7.3.12","v7.3.11","v7.3.10","v7.3.9","v7.3.8","v7.3.7","v7.3.6","v7.3.5","v7.3.4","v7.3.3","v7.3.2","v7.3.0","v7.2.9","v7.2.8","v7.2.7","v7.2.5","v7.2.4","v7.2.3","v7.2.2","v7.2.1","v7.2.0","v7.1.8","v7.1.7","v7.1.6","v7.1.3","v7.1.2","v7.1.1","v7.1.0","v7.0.3","v7.0.2","v7.0.1","v7.0.0","v6.3.13","v6.3.12","v6.3.11","v6.3.10","v6.3.9","v6.3.8","v6.3.7","v6.3.6","v6.3.5","v6.3.4","v6.3.3","v6.3.2","v6.3.1","v6.3.0","v6.2.4","v6.2.3","v6.2.2","v6.2.1","v6.2.0","v6.1.4","v6.1.3","v6.1.2","v6.1.1","v6.1.0","v6.0.0","v5.4.0","v5.3.3","v5.3.1","v5.3.0","v5.2.2","v5.2.1","v5.2.0","v5.1.0","v5.0.1","v5.0.0","v4.11.0","v4.10.3","v4.9.2","v4.9.1","v4.9.0","v4.8.1","v4.8.0","v4.7.0","v4.6.1","v4.6.0","v4.4.3","v4.4.2","v4.4.1","v4.4.0","v4.3.2","v4.3.0","v4.2.5","v4.2.4","v4.2.3","v4.2.2","v4.2.1","v4.2.0","v4.1.6","v4.1.5","v4.1.4","v4.1.3","v4.1.2","v4.1.0","v4.0.9","v4.0.8","v4.0.7","v4.0.6","v4.0.5","v4.0.4","v4.0.3","v4.0.2","v4.0.1","v4.0.0","v3.2.4","v3.2.3","v3.2.2","v3.2.1","v3.2.0","v3.1.2","v3.1.1","v3.1.0","v3.0.10","v3.0.9","v3.0.8","v3.0.7","v3.0.6","v3.0.5","v3.0.4","2.0.5","2.0.4","2.0.0","2.0-beta-build120","2.0-beta-build119"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-24828.json","vanir_signatures_modified":"2026-08-12T13:32:29Z","vanir_signatures":[{"source":"https://github.com/theonedev/onedev/commit/d67dd9686897fe5e4ab881d749464aa7c06a68e5","target":{"file":"server-core/src/main/java/io/onedev/server/migration/DataMigrator.java","function":"migrate42"},"deprecated":false,"digest":{"function_hash":"205644080855310684102357847310457983102","length":6166},"id":"CVE-2023-24828-016ab3fb","signature_type":"Function","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/theonedev/onedev/commit/d67dd9686897fe5e4ab881d749464aa7c06a68e5","target":{"file":"server-core/src/main/java/io/onedev/server/web/component/user/twofactorauthentication/TwoFactorAuthenticationSetupPanel.java"},"deprecated":false,"digest":{"line_hashes":["34484454488243352717750711315569175014","229359184494163523666988360693782983111","102291823583598711204964891994534802666","43417544776756315122099716252703733916","197396007464406695420858196674614471793","220410120081942762092591612855512989072","294423291940624074875763269268694802898","40623071868608862431337848979763999618","339683333482091597079855535613279323032","321610573393082491980696802366410773605","163670710514798590488053256424086377996","106385733045310555965589007383923676902","172771449018414888238778013641063754835","123938636046410299237985296877524582813","272914615851064708884367586021243135924","6179403917109183941692036988559036120","266290927866971724513030063662362460883","11718980548304050182706722193632128311","91646879048940189185801653980348186433","146080327270907132170441829022185446357","151317106491456138052173874619277170837","126600139303017718641279701140991625577","181702028395338403450882155218435660229","73528474828997915968482106158585814662","213551636604050895341307947806187569675","120913587746109617473066267811545336543","224185713401925760813188011174893491202","109348407894873665603857671679636004327","50655010624260041168324677530280507777"],"threshold":0.9},"id":"CVE-2023-24828-021dbb3b"},{"id":"CVE-2023-24828-08f1c130","signature_type":"Function","signature_version":"v1","source":"https://github.com/theonedev/onedev/commit/d67dd9686897fe5e4ab881d749464aa7c06a68e5","target":{"file":"server-core/src/main/java/io/onedev/server/web/component/user/accesstoken/AccessTokenPanel.java","function":"onClick"},"deprecated":false,"digest":{"function_hash":"200673137273799621725310979164570200952","length":270}},{"target":{"file":"server-core/src/main/java/io/onedev/server/web/component/user/twofactorauthentication/TwoFactorAuthenticationSetupPanel.java","function":"onSubmit"},"deprecated":false,"digest":{"function_hash":"11818508855085637785465204100743596138","length":2137},"id":"CVE-2023-24828-133e2e36","signature_type":"Function","signature_version":"v1","source":"https://github.com/theonedev/onedev/commit/d67dd9686897fe5e4ab881d749464aa7c06a68e5"},{"deprecated":false,"digest":{"function_hash":"70290041221264755430897412234928302965","length":4183},"id":"CVE-2023-24828-137404f4","signature_type":"Function","signature_version":"v1","source":"https://github.com/theonedev/onedev/commit/d67dd9686897fe5e4ab881d749464aa7c06a68e5","target":{"function":"onInitialize","file":"server-core/src/main/java/io/onedev/server/web/component/user/twofactorauthentication/TwoFactorAuthenticationSetupPanel.java"}},{"digest":{"line_hashes":["177764437201945390179223639666732076528","100302413421921315724805699748891053550","97350511054758052474736737181252517329","209362730421488110502975992075364317896","2141288207664452665160724541518860624","252409487546928585634370106875482447332","302072053231689020830669538431630448625","140671493421435258992437772930769191729","191254756534871233087591770955718767251","107434941686097280743950816858010711124","175234468212896337322377901631196769034","197583027913346035283572766043648698930","163227938343914575654963203425253583451","185567622523633668038083005290758537386","3353534947509643654441781636694763275","175948178036973690728391420362457259059","137499332656107079325547794008816369020","266921783618390337815477893966027850073","144648003389493172336123538218421645516","14467480352664649163615344117081043630","223406457339365569623065686624098041561","117271702538925995151676966482261260358","294138466007231446196995473133566039210"],"threshold":0.9},"id":"CVE-2023-24828-17a3ef70","signature_type":"Line","signature_version":"v1","source":"https://github.com/theonedev/onedev/commit/d67dd9686897fe5e4ab881d749464aa7c06a68e5","target":{"file":"server-core/src/main/java/io/onedev/server/web/page/simple/security/PasswordResetPage.java"},"deprecated":false},{"digest":{"function_hash":"151390395787979756279804736280593249887","length":3492},"id":"CVE-2023-24828-1d49610f","signature_type":"Function","signature_version":"v1","source":"https://github.com/theonedev/onedev/commit/d67dd9686897fe5e4ab881d749464aa7c06a68e5","target":{"file":"server-core/src/main/java/io/onedev/server/web/page/simple/security/PasswordResetPage.java","function":"onInitialize"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["120325696979703866886242223522695076050","4835940929587297382105392076220116011","159895289079858372418830760583312579266","240435539310969295819496526640967858011","264460501872395599063062705503683467450","207919467657263251630527384292475501073","142120722575460236454927179090374698310","161284747964642532489034542597982868876","55058152113087099252361130701163145953","152400974919847919328241973501685141126","220484778630974659089977783578564156936","145911561703446892153572005484744624991","27368387877645536707498772870906902514","328835782034823190592971359106029398043","302352263547832853761759709330737598884","67180782223523551373959495859159225319","140281292366819176423548293400014894943"],"threshold":0.9},"id":"CVE-2023-24828-26412f8f","signature_type":"Line","signature_version":"v1","source":"https://github.com/theonedev/onedev/commit/d67dd9686897fe5e4ab881d749464aa7c06a68e5","target":{"file":"server-core/src/main/java/io/onedev/server/util/CryptoUtils.java"}},{"id":"CVE-2023-24828-38a68077","signature_type":"Line","signature_version":"v1","source":"https://github.com/theonedev/onedev/commit/d67dd9686897fe5e4ab881d749464aa7c06a68e5","target":{"file":"server-core/src/main/java/io/onedev/server/web/component/user/accesstoken/AccessTokenPanel.java"},"deprecated":false,"digest":{"line_hashes":["146538345130655479313745337465723298479","91134726553060950099754829623832445747","102683363508703635955932099291259446469","178969120777820393104917866268749621942","165271520091876261626861876658774552831","84816632906070665815479476103998119954","209188232643315345774891830434651955045","87695552258930848151201683169184621040","192476825459188440351584040411886459408","152376838027711075988136317153678657297","9670685447431117301143376117009887956","175541998395662634578550502293003764058","226296152265928731873051605019932934795","199496491459216903969708405216979941355"],"threshold":0.9}},{"digest":{"function_hash":"184204300039882084969941095682678218254","length":2047},"id":"CVE-2023-24828-38b3c79c","signature_type":"Function","signature_version":"v1","source":"https://github.com/theonedev/onedev/commit/d67dd9686897fe5e4ab881d749464aa7c06a68e5","target":{"file":"server-core/src/main/java/io/onedev/server/web/page/simple/security/PasswordResetPage.java","function":"runTask"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"88132188824833095364556984515090065646","length":6766},"id":"CVE-2023-24828-43a3b34f","signature_type":"Function","signature_version":"v1","source":"https://github.com/theonedev/onedev/commit/d67dd9686897fe5e4ab881d749464aa7c06a68e5","target":{"file":"server-core/src/main/java/io/onedev/server/migration/DataMigrator.java","function":"migrate61"}},{"deprecated":false,"digest":{"line_hashes":["225375412423285825617687936201107615123","45031369314050861611499735077801701443","25275282854804608289654040031519073705","264931406496443481743619368397679011863","198846947713226510858858024886260911547","30909699846842807179336112607475263489","174762521791483107887231509080532556213","250083373923668930411074703068787458062","165290625325165146201795326474453680365","102732063557782669303068303083672251991","115615077903536387082985001417579971981","298025792602659397589992361309656224332","297248380518540713765726075167768148050","150001471303708585357196285856886546568","33649583210198742537140472367912268884","75519113499305573011480473616434120442","108587633537507210242609878158511307392"],"threshold":0.9},"id":"CVE-2023-24828-46fa6479","signature_type":"Line","signature_version":"v1","source":"https://github.com/theonedev/onedev/commit/d67dd9686897fe5e4ab881d749464aa7c06a68e5","target":{"file":"server-core/src/main/java/io/onedev/server/migration/DataMigrator.java"}},{"id":"CVE-2023-24828-491c804b","signature_type":"Line","signature_version":"v1","source":"https://github.com/theonedev/onedev/commit/d67dd9686897fe5e4ab881d749464aa7c06a68e5","target":{"file":"server-core/src/main/java/io/onedev/server/model/support/WebHook.java"},"deprecated":false,"digest":{"line_hashes":["54841453196833303586020376490012654665","123200737394920229034500833127712777830","10040136998227364996142417441746759235","33487381766960100926845891121321767597","90523533681461266110891543154068924904","300678681198505433626458894321723225942","37352866617825232954479189842565634193","299799257468717975386301430304788349883","245207629934948213923643255633982363767","32757326646635933426914248392805537043","92975286427359610063205953028137690318","166260761817065949968064190471256408555","51105458133381032654968176439723293846","284085809605966718783946009879887852706","130325686575762213250628145711078183114","276666413549074793414454271912638297224","147713836534490340682137882678307837780"],"threshold":0.9}},{"deprecated":false,"digest":{"function_hash":"27682102015994394292676446314770008102","length":864},"id":"CVE-2023-24828-5def0173","signature_type":"Function","signature_version":"v1","source":"https://github.com/theonedev/onedev/commit/d67dd9686897fe5e4ab881d749464aa7c06a68e5","target":{"file":"server-core/src/main/java/io/onedev/server/web/component/user/accesstoken/AccessTokenPanel.java","function":"onInitialize"}},{"signature_version":"v1","source":"https://github.com/theonedev/onedev/commit/d67dd9686897fe5e4ab881d749464aa7c06a68e5","target":{"file":"server-core/src/main/java/io/onedev/server/model/EmailAddress.java"},"deprecated":false,"digest":{"line_hashes":["120943872946505472517979859139232074985","136041384901830033236921831392598050878","282059101450594594506219373344056818606","114780353745837864563401920571445365013","68019595721108316193488295784747419471","27226061535685454048945301589554594134","76716397248608244372497547971501958474","253832037942233174538365289039513558348","319371527485638372367616144621169330720","87452209293233341415769543728401830832","306152618031706462500072763031080003911","282001751463913035441685070937913894798","305798657539907431638611280286474860063","98869367167721218294199920988164910030","324047794449643267183185660744351778499","265072968710540690738466996145116176480","305458457479236278197607039101383341471","127792966403577194419785287483091987016","193664813046255475156855774963050377278","131508632018055685007503525934721351258"],"threshold":0.9},"id":"CVE-2023-24828-d0b7815e","signature_type":"Line"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/theonedev/onedev/commit/d67dd9686897fe5e4ab881d749464aa7c06a68e5","target":{"file":"server-core/src/main/java/io/onedev/server/git/hook/HookUtils.java"},"deprecated":false,"digest":{"line_hashes":["77448481555953926368552706514672125998","128903784236150024561680478568938700635","34468840235018734983526440725461515409","298789914074936547252608159027416153113","84232482081658931895994273351542911388","317516201919861886508009709716532310752","58115129252570103160654067830323067193","168006546462740266275050937333138062520","38695559485711764093758827014276298123","262737889451691028118514429893852204742","239753388689269346725232802738767494327","237897188275560065188319701855631844073","207278177611986515056010806726412556569","250420042290421474625241858803453014663","218526678742962450941955966828080868827","276038346803354794945742693849631518406","296935002427980317814981536989540057882"],"threshold":0.9},"id":"CVE-2023-24828-f266badb"},{"target":{"file":"server-core/src/main/java/io/onedev/server/model/User.java"},"deprecated":false,"digest":{"line_hashes":["142467036512825116418517604602569569254","62640144313424347706800916951843156059","28419970155381762999991334389173020064","308845511669724303989246774150627081988","4189556169288211909373983332580260354","198605363911037618170318576321344986122","6320549534345276462169339939129960708","58404570089824029138921605959315900740","185430097771420980438277116055605408420","48592873438451391366319143609206713242","293559114017248857265427773313810414433","129661150278783117044424672117700864267","111524956893454479396902508484256424388","128548066215904714728215229799024545650","28365910838151882289814576533696453045","242105709852794069252846040869076036106","320674012911039641259830196151464939772","155701283237715769548314414326256590036","137381725236383815738345483280936439557","234158497749718234535496667050821751192","46270311382451539636603156894914646022","231123291780480607477459515454466672253","168147460002991728094456699989963202234","213388580542165691857047322645066693836","121730398262773760112370303256500073916","253260225186203569596548183602754084842","146083765597706692415761244492496548086","298175813493169608170779091767383707372","302592969021410412396250728288228630154","50410454057803868069858134550403773053","338685926479294039912447008740797509504","216616436967139813192065804894410492249","308041041563548006067029534614707798702","326139865137504693876801258978996985192","319738633706636684155178904474269117664","254542626390085219664092617956179157974","62069688170786622902457584330038335511","69541203825609850909362364634962070639","149957326085092462914287598161961483887","217587319762717093134539493814683656552","152375755749742210086564265813584490584","155443473577965534797412235814580414287","289898773119947001303999631959056410869","118813076331454664459940972752903816719","171815099669541950988873376706285180548","27206459051874309946856097190770714419","223799374237038458370876218187207488999","284906625032902930870689139399757182814","32132402982507824972757103469556300102","207272119184774523666972679800530080543"],"threshold":0.9},"id":"CVE-2023-24828-f8ec777b","signature_type":"Line","signature_version":"v1","source":"https://github.com/theonedev/onedev/commit/d67dd9686897fe5e4ab881d749464aa7c06a68e5"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"}]}