GitHub Advisoryadvisory · Go

GHSA-6h8c-gw33-cjm2 DevSpace vulnerable to remote code execution

CRITICAL Published 2022-05-24 Modified 2023-10-19 Official page ↗
Aliases
CVE-2020-15391
Ecosystem
Go
Packages
github.com/loft-sh/devspace
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-287, CWE-306
Reviewed
2023-10-19

Affected packages

• Go github.com/loft-sh/devspace: < 4.14.0 → fixed in 4.14.0

Description

The UI in DevSpace 4.13.0 allows web sites to execute actions on pods (on behalf of a victim) because of a lack of authentication for the WebSocket protocol. This leads to remote code execution.

Related

Alias · CVE (1)

  • CVE-2020-15391 The UI in DevSpace 4.13.0 allows web sites to execute actions on pods (on behalf of a victim) because of a lack of authentication for the… vulnerability

Weakness · CWE (2)

  • CWE-287 Improper Authentication weakness
  • CWE-306 Missing Authentication for Critical Functionality weakness

References