PT-2022-11652 · Coder · Code-Server

Jyhtpyo · Published 2022-05-11 · Updated 2022-05-20 · CVE-2021-42648

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Coder Code-Server versions prior to 3.12.0

Description A cross-site scripting (XSS) issue exists, allowing attackers to execute arbitrary code via a crafted URL. This enables the execution of malicious scripts, potentially leading to unauthorized actions on the affected system.

Recommendations For versions prior to 3.12.0, update to version 3.12.0 or later to resolve the issue. As a temporary workaround, consider restricting access to crafted URLs to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-42648

GHSA-2GP3-6C9P-JP7W

Affected Products

Code-Server

References · 8

• 🔥 https://github.com/cdr/code-server/issues/4355 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-42648 · Security Note
• https://osv.dev/vulnerability/CVE-2021-42648 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2gp3-6c9p-jp7w · Vendor Advisory
• https://github.com/coder/code-server · Note
• https://github.com/coder/code-server/pull/4430 · Note
• https://t.me/cvenotify/30047 · Telegram Post
• https://t.me/cibsecurity/42406 · Telegram Post