Lucene search

GoogleOSV:GHSA-FRJG-G767-7363

HistoryMar 23, 2023 - 6:30 a.m.

code-server vulnerable to Missing Origin Validation in WebSockets

2023-03-2306:30:15

Google

osv.dev

code-server

vulnerability

websockets

exploitation

software security

9.3 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

0.001 Low

EPSS

Percentile

47.7%

JSON

Versions of the package code-server before 4.10.1 are vulnerable to Missing Origin Validation in WebSockets handshakes. Exploiting this vulnerability can allow an adversary in specific scenarios to access data from and connect to the code-server instance.

CPENameOperatorVersion
code-serverlt4.10.1

CPE	Name	Operator	Version
	code-server	lt	4.10.1

References

github.com/coder/code-server

github.com/coder/code-server/commit/d477972c68fc8c8e8d610aa7287db87ba90e55c7

github.com/coder/code-server/releases/tag/v4.10.1

nvd.nist.gov/vuln/detail/CVE-2023-26114

security.snyk.io/vuln/SNYK-JS-CODESERVER-3368148

9.3 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

0.001 Low

EPSS

Percentile

47.7%

JSON

Related for OSV:GHSA-FRJG-G767-7363