PT-2023-20500 · Unknown · Code-Server

Publicado 2023-03-23 · Atualizado 2025-02-25 · CVE-2023-26114

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions code-server versions prior to 4.10.1

Description The issue is related to Missing Origin Validation in WebSockets handshakes. This can allow an adversary in specific scenarios to access data from and connect to the code-server instance.

Recommendations For versions prior to 4.10.1, update to version 4.10.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the WebSockets handshake functionality until a patch is applied.

Correção

Origin Validation Error

Enumeração de Fraquezas

CWE-346

CWE-1385

Identificadores relacionados

CVE-2023-26114

GHSA-FRJG-G767-7363

Produtos afetados

Code-Server

Referências · 10

• https://github.com/coder/code-server · Nota
• https://github.com/coder/code-server/commit/d477972c68fc8c8e8d610aa7287db87ba90e55c7 · Correção
• https://github.com/coder/code-server/releases/tag/v4.10.1 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-26114 · Nota de Segurança
• https://security.snyk.io/vuln/SNYK-JS-CODESERVER-3368148 · Correção
• https://osv.dev/vulnerability/CVE-2023-26114 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-frjg-g767-7363 · Aviso do Fabricante
• https://t.me/cvenotify/112466 · Publicação no Telegram
• https://t.me/cibsecurity/60545 · Publicação no Telegram
• https://t.me/cvenotify/46697 · Publicação no Telegram