GitHub Advisoryadvisory · npm

GHSA-frjg-g767-7363 code-server vulnerable to Missing Origin Validation in WebSockets

CRITICAL Published 2023-03-23 Modified 2023-03-27 Official page ↗
Aliases
CVE-2023-26114
Ecosystem
npm
Packages
code-server
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Weaknesses
CWE-1385, CWE-346
Reviewed
2023-03-23

Affected packages

• npm code-server: < 4.10.1 → fixed in 4.10.1

Description

Versions of the package code-server before 4.10.1 are vulnerable to Missing Origin Validation in WebSockets handshakes. Exploiting this vulnerability can allow an adversary in specific scenarios to access data from and connect to the code-server instance.

Related

Alias · CVE (1)

  • CVE-2023-26114 Versions of the package code-server before 4.10.1 are vulnerable to Missing Origin Validation in WebSockets handshakes. vulnerability

Weakness · CWE (2)

  • CWE-1385 Missing Origin Validation in WebSockets weakness
  • CWE-346 Origin Validation Error weakness

References