com.consol.citrus:citrus-websocket (>=2.6.1, <=2.6.2), org.kurento:kurento-jsonrpc-server (6.6.0) +5 more potentially affected by CVE-2026-41838 via org.springframework:spring-websocket (4.2.7.release)

org.springframework:spring-websocket MAVEN version 4.2.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - com.consol.citrus:citrus-websocket =2.6.1, =1.3.6.release, =4.2.9.release,...

com.consol.citrus:citrus-websocket (>=2.6.1, <=2.6.2), org.kurento:kurento-jsonrpc-server (6.6.0) +5 more potentially affected by CVE-2025-41254 via org.springframework:spring-websocket (4.2.7.release)

org.springframework:spring-websocket MAVEN version 4.2.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - com.consol.citrus:citrus-websocket =2.6.1, =1.3.6.release, =4.2.9.release,...

Cross site scripting

An issue was discovered in Gitpod versions prior to release-2022.11.2.16. There is a Cross-Site WebSocket Hijacking CSWSH vulnerability that allows attackers to make WebSocket connections to the Gitpod JSONRPC server using a victim’s credentials, because the Origin header is not restricted. This...

CVE-2023-0957

An issue was discovered in Gitpod versions prior to release-2022.11.2.16. There is a Cross-Site WebSocket Hijacking CSWSH vulnerability that allows attackers to make WebSocket connections to the Gitpod JSONRPC server using a victim’s credentials, because the Origin header is not restricted. This...

CVE-2023-0957

An issue was discovered in Gitpod versions prior to release-2022.11.2.16. There is a Cross-Site WebSocket Hijacking CSWSH vulnerability that allows attackers to make WebSocket connections to the Gitpod JSONRPC server using a victim’s credentials, because the Origin header is not restricted. This...

CVE-2023-0957: Missing Origin Validation in WebSockets

An issue was discovered in Gitpod versions prior to release-2022.11.2.16. There is a Cross-Site WebSocket Hijacking CSWSH vulnerability that allows attackers to make WebSocket connections to the Gitpod JSONRPC server using a victim’s credentials, because the Origin header is not restricted. This...

PT-2023-16641

Name of the Vulnerable Software and Affected Versions Gitpod versions prior to release-2022.11.2.16 Description The issue allows attackers to make WebSocket connections to the Gitpod JSONRPC server using a victim’s credentials due to the lack of restriction on the Origin header. This can lead to...