CVE-2023-7210

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-7210
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-7210.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-7210
Aliases
  • GHSA-353q-7h99-hf4x
Published
2024-01-07T09:31:03.947Z
Modified
2026-08-12T03:51:33.134414242Z
Severity
  • 7.3 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
Summary
OneNav API improper authentication
Details

A vulnerability was found in OneNav up to 0.9.33. It has been classified as critical. This affects an unknown part of the file /index.php?c=api of the component API. The manipulation of the argument X-Token leads to improper authentication. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249765 was assigned to this vulnerability.

Database specific 
{
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "0.9.0"
                },
                {
                    "last_affected": "0.9.0"
                },
                {
                    "introduced": "0.9.1"
                },
                {
                    "last_affected": "0.9.1"
                },
                {
                    "introduced": "0.9.2"
                },
                {
                    "last_affected": "0.9.2"
                },
                {
                    "introduced": "0.9.3"
                },
                {
                    "last_affected": "0.9.3"
                },
                {
                    "introduced": "0.9.4"
                },
                {
                    "last_affected": "0.9.4"
                },
                {
                    "introduced": "0.9.5"
                },
                {
                    "last_affected": "0.9.5"
                },
                {
                    "introduced": "0.9.6"
                },
                {
                    "last_affected": "0.9.6"
                },
                {
                    "introduced": "0.9.7"
                },
                {
                    "last_affected": "0.9.7"
                },
                {
                    "introduced": "0.9.8"
                },
                {
                    "last_affected": "0.9.8"
                },
                {
                    "introduced": "0.9.9"
                },
                {
                    "last_affected": "0.9.9"
                },
                {
                    "introduced": "0.9.10"
                },
                {
                    "last_affected": "0.9.10"
                },
                {
                    "introduced": "0.9.11"
                },
                {
                    "last_affected": "0.9.11"
                },
                {
                    "introduced": "0.9.12"
                },
                {
                    "last_affected": "0.9.12"
                },
                {
                    "introduced": "0.9.13"
                },
                {
                    "last_affected": "0.9.13"
                },
                {
                    "introduced": "0.9.14"
                },
                {
                    "last_affected": "0.9.14"
                },
                {
                    "introduced": "0.9.15"
                },
                {
                    "last_affected": "0.9.15"
                },
                {
                    "introduced": "0.9.16"
                },
                {
                    "last_affected": "0.9.16"
                },
                {
                    "introduced": "0.9.17"
                },
                {
                    "last_affected": "0.9.17"
                },
                {
                    "introduced": "0.9.18"
                },
                {
                    "last_affected": "0.9.18"
                },
                {
                    "introduced": "0.9.19"
                },
                {
                    "last_affected": "0.9.19"
                },
                {
                    "introduced": "0.9.20"
                },
                {
                    "last_affected": "0.9.20"
                },
                {
                    "introduced": "0.9.21"
                },
                {
                    "last_affected": "0.9.21"
                },
                {
                    "introduced": "0.9.22"
                },
                {
                    "last_affected": "0.9.22"
                },
                {
                    "introduced": "0.9.23"
                },
                {
                    "last_affected": "0.9.23"
                },
                {
                    "introduced": "0.9.24"
                },
                {
                    "last_affected": "0.9.24"
                },
                {
                    "introduced": "0.9.25"
                },
                {
                    "last_affected": "0.9.25"
                },
                {
                    "introduced": "0.9.26"
                },
                {
                    "last_affected": "0.9.26"
                },
                {
                    "introduced": "0.9.27"
                },
                {
                    "last_affected": "0.9.27"
                },
                {
                    "introduced": "0.9.28"
                },
                {
                    "last_affected": "0.9.28"
                },
                {
                    "introduced": "0.9.29"
                },
                {
                    "last_affected": "0.9.29"
                },
                {
                    "introduced": "0.9.30"
                },
                {
                    "last_affected": "0.9.30"
                },
                {
                    "introduced": "0.9.31"
                },
                {
                    "last_affected": "0.9.31"
                },
                {
                    "introduced": "0.9.32"
                },
                {
                    "last_affected": "0.9.32"
                },
                {
                    "introduced": "0.9.33"
                },
                {
                    "last_affected": "0.9.33"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "cna_assigner": "VulDB",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/7xxx/CVE-2023-7210.json",
    "cwe_ids": [
        "CWE-287"
    ]
}
References

Affected packages

Git / github.com/helloxz/onenav

Affected ranges

Type
GIT
Repo
https://github.com/helloxz/onenav
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
d5003b44e171ce99047505ccfa33b0d5d4f10837
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.9.33"
        }
    ],
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:onenav:onenav:*:*:*:*:*:*:*:*"
}

Affected versions

0.*
0.9.1
0.9.10
0.9.11
0.9.12
0.9.13
0.9.14
0.9.15
0.9.16
0.9.17
0.9.18
0.9.19
0.9.2
0.9.20
0.9.21
0.9.22
0.9.23
0.9.24
0.9.25
0.9.26
0.9.27
0.9.28
0.9.29
0.9.3
0.9.30
0.9.31
0.9.32
0.9.33
0.9.4
0.9.5
0.9.6
0.9.7
0.9.8
0.9.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-7210.json"