CVE-2023-7210

OneNav API improper authentication

State: Published
Severity: 7.3 High
Published: Jan 7, 2024
Updated: Nov 14, 2024
Reserved: Jan 5, 2024

Description

A vulnerability was found in OneNav up to 0.9.33. It has been classified as critical. This affects an unknown part of the file /index.php?c=api of the component API. The manipulation of the argument X-Token leads to improper authentication. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249765 was assigned to this vulnerability.

Scores

CVSS	Score	Vector	Source
3.1	7.3 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L	VulDB
3.0	7.3 High	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L	VulDB
2.0	7.5 High	AV:N/AC:L/Au:N/C:P/I:P/A:P	VulDB

Weaknesses

CWE-287 Improper Authentication

Affected Products

Product	Versions
OneNavn/a	0.9.0Affected 0.9.1Affected 0.9.2Affected 0.9.3Affected 0.9.4Affected 0.9.5Affected 0.9.6Affected 0.9.7Affected 0.9.8Affected 0.9.9Affected 0.9.10Affected 0.9.11Affected 0.9.12Affected 0.9.13Affected 0.9.14Affected 0.9.15Affected 0.9.16Affected 0.9.17Affected 0.9.18Affected 0.9.19Affected 0.9.20Affected 0.9.21Affected 0.9.22Affected 0.9.23Affected 0.9.24Affected and 9 more versions

References

https://vuldb.com/?id.249765vdb-entrytechnical-description
https://vuldb.com/?ctiid.249765signaturepermissions-required
https://note.zhaoj.in/share/eRbUygGMiJcpbroken-linkexploit

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.