CVE-2023-30856

🗓️ 28 Apr 2023 15:54:54Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 132 Views🌐 WEB

eDEX-UI 2.2.8 and prior allows cross-site websocket hijacking

Reporter	Title	Published	Views	Family All 12
GithubExploit	Exploit for Origin Validation Error in Edex-Ui_Project Edex-Ui	24 Sep 202519:13	–	githubexploit
Circl	CVE-2023-30856	28 Apr 202320:27	–	circl
CNNVD	eDEX-UI 访问控制错误漏洞	28 Apr 202300:00	–	cnnvd
Cvelist	CVE-2023-30856 eDEX-UI cross-site websocket hijacking vulnerability enables remote command execution	28 Apr 202315:54	–	cvelist
EUVD	EUVD-2023-35200	3 Oct 202520:07	–	euvd
Mend	CVE-2023-30856	28 Apr 202315:54	–	mend
NVD	CVE-2023-30856	28 Apr 202316:15	–	nvd
Prion	Cross site scripting	28 Apr 202316:15	–	prion
Positive Technologies	PT-2023-23012	28 Apr 202300:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2023-30856: Missing Origin Validation in WebSockets	28 Apr 202300:00	–	rapid7

NVD

Vulners

Node

edex-ui_project edex-uiRange≤2.2.8

[
  {
    "vendor": "GitSquared",
    "product": "edex-ui",
    "versions": [
      {
        "version": "<= 2.2.8",
        "status": "affected"
      }
    ]
  }
]

Source	Link
christian-schneider	www.christian-schneider.net/CrossSiteWebSocketHijacking.html
github	www.github.com/GitSquared/edex-ui/security/advisories/GHSA-q8xc-f2wf-ffh9
github	www.github.com/GitSquared/edex-ui/blob/04a00c4079908788b371c6ecdefff96d0d9950f8/src/classes/terminal.class.js

Parameter	Position	Path	Description	CWE
Origin	header	ws://localhost:3000	WebSocket endpoint vulnerable to cross-site WebSocket hijacking enabling remote command execution via arbitrary commands over the WS handshake.	CWE-346, CWE-1385

17 Jun 2026 05:55Current

9.3Critical risk

Vulners AI Score9.3

CVSS 3.18.3 - 10

EPSS0.00348

SSVC