5 matches found
CVE-2021-41038
In versions of the @theia/plugin-ext component of Eclipse Theia prior to 1.18.0, Webview contents can be hijacked via postMessage...
@popcornsar/che-theia-plugin-ext (7.4.0), @popcornsar/theia-dashboard-extension (7.4.0-v1) +11 more potentially affected by CVE-2021-41038 via @theia/plugin-ext (>=1.0.0, <=1.17.2)
@theia/plugin-ext NPM version =1.0.0, =1.1.0-next.14531578, =1.1.0-next.14531578, =1.1.0-next.14531578, =1.1.0-next.14531578, =0.0.17, =0.0.6, =0.0.6, =0.0.6, =0.0.6, =0.0.6, =0.0.19 Source cves: CVE-2021-41038 Source advisory: OSV:GHSA-W6V7-W58J-PG5R...
CVE-2021-41038
In versions of the @theia/plugin-ext component of Eclipse Theia prior to 1.18.0, Webview contents can be hijacked via postMessage...
CVE-2021-41038
The CVE-2021-41038 entry concerns the @theia/plugin-ext component of Eclipse Theia (pre-1.18.0). The issue is that Webview contents can be hijacked via postMessage(), caused by improper verification of the communication channel. This mode of exploitation could expose or modify Webview content dep...
