Lucene search

GitHub Advisory DatabaseGHSA-FRJG-G767-7363

HistoryMar 23, 2023 - 6:30 a.m.

code-server vulnerable to Missing Origin Validation in WebSockets

2023-03-2306:30:15

CWE-346

CWE-1385

GitHub Advisory Database

github.com

code-server

vulnerability

websocket

missing origin validation

exploiting

adversary

data access

9.3 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

0.001 Low

EPSS

Percentile

47.7%

JSON

Versions of the package code-server before 4.10.1 are vulnerable to Missing Origin Validation in WebSockets handshakes. Exploiting this vulnerability can allow an adversary in specific scenarios to access data from and connect to the code-server instance.

Affected configurations

Vulners

Node

codeserverRange<4.10.1

CPENameOperatorVersion
code-serverlt4.10.1

CPE	Name	Operator	Version
	code-server	lt	4.10.1

References

github.com/advisories/GHSA-frjg-g767-7363

github.com/coder/code-server/commit/d477972c68fc8c8e8d610aa7287db87ba90e55c7

github.com/coder/code-server/releases/tag/v4.10.1

nvd.nist.gov/vuln/detail/CVE-2023-26114

security.snyk.io/vuln/SNYK-JS-CODESERVER-3368148

9.3 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

0.001 Low

EPSS

Percentile

47.7%

JSON

Related for GHSA-FRJG-G767-7363