CVE-2021-38712

HIGH

OneNav 0.9.12 - Information Disclosure via Database File Exposure

Title source: llm

Description

OneNav 0.9.12 allows Information Disclosure of the onenav.db3 contents. NOTE: the vendor's recommended solution is to block the access via an NGINX configuration file.

References (1)

Core 1

Core References

Exploit, Issue Tracking, Third Party Advisory x_refsource_misc

https://github.com/helloxz/onenav/issues/25

Scores

CVSS v3 7.5

EPSS 0.0115

EPSS Percentile 62.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE

CWE-668

Status published

Products (1)

onenav/onenav 0.9.12

Published Aug 16, 2021

Tracked Since Feb 18, 2026