CVE-2023-30856

🗓️ 28 Apr 2023 15:54:54Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 80 Views🌐 WEB

eDEX-UI 2.2.8 and prior allows cross-site websocket hijacking

Reporter	Title	Published	Views	Family All 11
GithubExploit	Exploit for Origin Validation Error in Edex-Ui_Project Edex-Ui	24 Sep 202519:13	–	githubexploit
Circl	CVE-2023-30856	28 Apr 202320:27	–	circl
CNNVD	eDEX-UI 访问控制错误漏洞	28 Apr 202300:00	–	cnnvd
Cvelist	CVE-2023-30856 eDEX-UI cross-site websocket hijacking vulnerability enables remote command execution	28 Apr 202315:54	–	cvelist
EUVD	EUVD-2023-35200	3 Oct 202520:07	–	euvd
NVD	CVE-2023-30856	28 Apr 202316:15	–	nvd
OSV	CVE-2023-30856 eDEX-UI cross-site websocket hijacking vulnerability enables remote command execution	28 Apr 202315:54	–	osv
Prion	Cross site scripting	28 Apr 202316:15	–	prion
Positive Technologies	PT-2023-23012	28 Apr 202300:00	–	ptsecurity
RedhatCVE	CVE-2023-30856	23 May 202502:34	–	redhatcve

NVD

Vulners

Node

edex-ui_project edex-uiRange≤2.2.8

[
  {
    "vendor": "GitSquared",
    "product": "edex-ui",
    "versions": [
      {
        "version": "<= 2.2.8",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/GitSquared/edex-ui/blob/04a00c4079908788b371c6ecdefff96d0d9950f8/src/classes/terminal.class.js
github	www.github.com/GitSquared/edex-ui/security/advisories/GHSA-q8xc-f2wf-ffh9
christian-schneider	www.christian-schneider.net/CrossSiteWebSocketHijacking.html

Parameter	Position	Path	Description	CWE
Origin	header	localhost:3000	WebSocket server accepts connections from any origin without proper validation, enabling cross-site WebSocket hijacking and potential remote command execution via ws://localhost:3000.	CWE-1385, CWE-346

21 Nov 2024 08:00Current

9.3High risk

Vulners AI Score9.3

CVSS 3.18.3 - 10

EPSS0.00229

SSVC