PatchTheCVEonekeyadmin vulnerabilities and fixes
Recent CVEs affecting onekeyadmin, with upgrade or downgrade steps. 10 tracked.
onekeyadmin has 10 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 0. Most recent: 2023-03-16. Highest priority: CVE-2023-26949 (score 59/100).
- CVE-2023-26957 CRITICAL 9.1 DOWNGRADE onekeyadmin v1.3.9 was discovered to contain an arbitrary file delete vulnerability via the component \admin\c
- CVE-2023-26956 HIGH 7.5 DOWNGRADE onekeyadmin v1.3.9 was discovered to contain an arbitrary file read vulnerability via the component /admin1/cu
- CVE-2023-26955 MEDIUM 5.4 DOWNGRADE onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Admin G
- CVE-2023-26954 MEDIUM 5.4 DOWNGRADE onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the User Gr
- CVE-2023-26953 MEDIUM 4.8 DOWNGRADE onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Add Adm
- CVE-2023-26952 MEDIUM 5.4 DOWNGRADE onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Add Men
- CVE-2023-26951 MEDIUM 5.4 DOWNGRADE onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Member
- CVE-2023-26950 MEDIUM 5.4 DOWNGRADE onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Title p
- CVE-2023-26949 CRITICAL 9.8 DOWNGRADE An arbitrary file upload vulnerability in the component /admin1/config/update of onekeyadmin v1.3.9 allows att
- CVE-2023-26948 HIGH 7.5 DOWNGRADE onekeyadmin v1.3.9 was discovered to contain an arbitrary file read vulnerability via the component /admin1/fi
FAQ
How do I fix onekeyadmin vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is onekeyadmin being exploited right now?
None of the tracked onekeyadmin CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which onekeyadmin CVE should I patch first?
CVE-2023-26949 currently ranks highest (59/100): An arbitrary file upload vulnerability in the component /admin1/config/update of onekeyadmin v1.3.9 allows att.