CVE-2023-26114

Summary

Versions of the package code-server before 4.10.1 are vulnerable to Missing Origin Validation in WebSockets handshakes. Exploiting this vulnerability can allow an adversary in specific scenarios to access data from and connect to the code-server instance.

Affected Software

Weaknesses

• CWE-1385: Missing Origin Validation in WebSockets

ADP Enrichment

CVE Program Container

Additional References

• https://security.snyk.io/vuln/SNYK-JS-CODESERVER-3368148
• https://github.com/coder/code-server/commit/d477972c68fc8c8e8d610aa7287db87ba90e55c7
• https://github.com/coder/code-server/releases/tag/v4.10.1

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: total

References

• https://security.snyk.io/vuln/SNYK-JS-CODESERVER-3368148
• https://github.com/coder/code-server/commit/d477972c68fc8c8e8d610aa7287db87ba90e55c7
• https://github.com/coder/code-server/releases/tag/v4.10.1

• ←Previous
• Next→