PT-2023-10141 · Lukehutch · Gribbit

Lukehutch · Publicado 2023-01-09 · Atualizado 2024-05-17 · CVE-2014-125071

Positive Technologies (AI Summary)

CVSS v2.0

5.2

Média

Vetor base

AV:A/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions lukehutch Gribbit (affected versions not specified)

Description A problematic issue was found in lukehutch Gribbit, affecting the messageReceived function of the file src/gribbit/request/HttpRequestHandler.java. This issue leads to missing origin validation in websockets.

Recommendations Apply a patch to fix this issue, specifically the patch named 620418df247aebda3dd4be1dda10fe229ea505dd. As a temporary workaround, consider disabling the messageReceived function until a patch is available. Restrict access to the vulnerable HttpRequestHandler.java file to minimize the risk of exploitation.

Correção

Origin Validation Error

Enumeração de Fraquezas

CWE-346

CWE-1385

Identificadores relacionados

CVE-2014-125071

Produtos afetados

Gribbit

Referências · 5

• https://vuldb.com/?ctiid.217716 · Nota
• https://vuldb.com/?id.217716 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-125071 · Nota de Segurança
• https://github.com/lukehutch/gribbit/commit/620418df247aebda3dd4be1dda10fe229ea505dd · Correção
• https://t.me/cibsecurity/56183 · Publicação no Telegram