Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2024-45309— OneDev vulnerable to arbitrary file reading for unauthenticated user

Quick assessment

Affected
theonedev onedev
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

OneDev是Theonedev团队的一个基于JAVA的多合一DevOps平台。该平台支持容器构建、编排、CI、Git管理、团队协作等功能，帮助开发者构建一个简单、功能强大的开发平台。 OneDev 11.0.9之前版本存在安全漏洞，该漏洞源于允许未经身份验证的用户读取服务器进程，从而可以访问任意文件。

AI Predicted 7.5 Difficulty: Trivial EPSS 24.53% · P98

Possible ATT&CK Techniques 1 AI

T1555 · Credentials from Password Stores
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2024-45309

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
OneDev vulnerable to arbitrary file reading for unauthenticated user
Source: CVE Program / CVE List V5
Vulnerability Description
OneDev is a Git server with CI/CD, kanban, and packages. A vulnerability in versions prior to 11.0.9 allows unauthenticated users to read arbitrary files accessible by the OneDev server process. This issue has been fixed in version 11.0.9.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5
Vulnerability Title
OneDev 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
OneDev是Theonedev团队的一个基于JAVA的多合一DevOps平台。该平台支持容器构建、编排、CI、Git管理、团队协作等功能，帮助开发者构建一个简单、功能强大的开发平台。 OneDev 11.0.9之前版本存在安全漏洞，该漏洞源于允许未经身份验证的用户读取服务器进程，从而可以访问任意文件。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Shenlong Deep Dive — AI Deep Analysis

10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.

Read summary Full analysis (login)

Affected Products

Vendor Product Affected Versions CPE Subscribe
theonedev onedev < 11.0.9 -

II. Public POCs for CVE-2024-45309

# POC Description Source Link Shenlong Link
1 Files on the host computer can be accessed by directory traversal. https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-45309.yaml POC Details
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2024-45309

请登录查看更多情报信息。

Patches & Fixes for CVE-2024-45309 (1)

IV. Related Vulnerabilities

Same product: onedev
Same vendor: theonedev
Same weakness: CWE-200

V. Comments for CVE-2024-45309

No comments yet

Leave a comment