CVE-2022-39207

🗓️ 13 Sep 2022 18:50:09Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 4 Media mentions👁 54 Views

Onedev Git Server allows XSS via crafted build artifacts, leading to session hijacking and potential admin privilege escalation. Upgrade to version 7.3.0. No workarounds available

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2022-39207	13 Sep 202222:31	–	circl
CNNVD	Theonedev Onedev 跨站脚本漏洞	13 Sep 202200:00	–	cnnvd
Cvelist	CVE-2022-39207 Persistent XSS in OneDev	13 Sep 202218:50	–	cvelist
EUVD	EUVD-2022-41746	3 Oct 202520:07	–	euvd
NVD	CVE-2022-39207	13 Sep 202219:15	–	nvd
OSV	CVE-2022-39207 Persistent XSS in OneDev	13 Sep 202218:50	–	osv
Prion	Cross site scripting	13 Sep 202219:15	–	prion
Positive Technologies	PT-2022-24807 · Onedev · Onedev	13 Sep 202200:00	–	ptsecurity
RedhatCVE	CVE-2022-39207	22 May 202522:11	–	redhatcve
Vulnrichment	CVE-2022-39207 Persistent XSS in OneDev	13 Sep 202218:50	–	vulnrichment

NVD

Vulners

Node

onedev_project onedevRange<7.3.0

[
  {
    "product": "onedev",
    "vendor": "theonedev",
    "versions": [
      {
        "status": "affected",
        "version": "< 7.3.0"
      }
    ]
  }
]

Source	Link
github	www.github.com/theonedev/onedev/security/advisories/GHSA-27fw-gv88-qrpg
blog	www.blog.sonarsource.com/onedev-remote-code-execution/
github	www.github.com/theonedev/onedev/commit/adb6e31476621f824fc3227a695232df830d83ab