title: OneNav API improper authentication
description: A vulnerability was found in OneNav up to 0.9.33. It has been classified as critical. This affects an unknown part of the file /index.php?c=api of the component API. The manipulation of the argument X-Token leads to improper authentication. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249765 was assigned to this vulnerability.
problem types: CWE-287 Improper Authentication
affected:
{
vendor: n/a
product: OneNav
versions:
version: 0.9.0, status: affected
version: 0.9.1, status: affected
version: 0.9.2, status: affected
version: 0.9.3, status: affected
version: 0.9.4, status: affected
version: 0.9.5, status: affected
version: 0.9.6, status: affected
version: 0.9.7, status: affected
version: 0.9.8, status: affected
version: 0.9.9, status: affected
version: 0.9.10, status: affected
version: 0.9.11, status: affected
version: 0.9.12, status: affected
version: 0.9.13, status: affected
version: 0.9.14, status: affected
version: 0.9.15, status: affected
version: 0.9.16, status: affected
version: 0.9.17, status: affected
version: 0.9.18, status: affected
version: 0.9.19, status: affected
version: 0.9.20, status: affected
version: 0.9.21, status: affected
version: 0.9.22, status: affected
version: 0.9.23, status: affected
version: 0.9.24, status: affected
version: 0.9.25, status: affected
version: 0.9.26, status: affected
version: 0.9.27, status: affected
version: 0.9.28, status: affected
version: 0.9.29, status: affected
version: 0.9.30, status: affected
version: 0.9.31, status: affected
version: 0.9.32, status: affected
version: 0.9.33, status: affected
modules: API
}
metrics:
cvssV3_1: [
version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
baseSeverity: HIGH
]