Description

Versions of the package code-server before 4.10.1 are vulnerable to Missing Origin Validation in WebSockets handshakes. Exploiting this vulnerability can allow an adversary in specific scenarios to access data from and connect to the code-server instance.

Remediation

References

https://github.com/coder/code-server/commit/d477972c68fc8c8e8d610aa7287db87ba90e55c7

https://github.com/coder/code-server/releases/tag/v4.10.1

https://security.snyk.io/vuln/SNYK-JS-CODESERVER-3368148

Related Vulnerabilities

CVE-2022-24728 Vulnerability in npm package ckeditor4

CVE-2018-1273 Vulnerability in maven package org.springframework.data:spring-data-commons

CVE-2023-34465 Vulnerability in maven package org.xwiki.platform:xwiki-platform-security-authorization-bridge

CVE-2022-25873 Vulnerability in maven package org.webjars.bowergithub.vuetifyjs:vuetify

CVE-2018-9159 Vulnerability in maven package com.sparkjava:spark-core

Severity

Critical

Classification

CWE-346 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Tags

Patch Release Notes