CVE-2023-26114

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-26114
Versions of the package code-server before 4.10.1 are vulnerable to Missing Origin Validation in WebSockets handshakes. Exploiting this vulnerability can allow an adversary in specific scenarios to access data from and connect to the code-server instance.

8.2 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.6 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact LOW

Scope CHANGED

References
Link Resource
https://github.com/coder/code-server/commit/d477972c68fc8c8e8d610aa7287db87ba90e55c7 Patch
https://github.com/coder/code-server/releases/tag/v4.10.1 Release Notes
https://security.snyk.io/vuln/SNYK-JS-CODESERVER-3368148 Patch
https://github.com/coder/code-server/commit/d477972c68fc8c8e8d610aa7287db87ba90e55c7 Patch
https://github.com/coder/code-server/releases/tag/v4.10.1 Release Notes
https://security.snyk.io/vuln/SNYK-JS-CODESERVER-3368148 Patch
Configurations

Configuration 1 (hide)

cpe:2.3:a:coder:code-server:*:*:*:*:*:*:*:*
History

21 Nov 2024, 07:50

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 9.3 		v2 : unknown
v3 : 8.2
References () https://github.com/coder/code-server/commit/d477972c68fc8c8e8d610aa7287db87ba90e55c7 - Patch () https://github.com/coder/code-server/commit/d477972c68fc8c8e8d610aa7287db87ba90e55c7 - Patch
References () https://github.com/coder/code-server/releases/tag/v4.10.1 - Release Notes () https://github.com/coder/code-server/releases/tag/v4.10.1 - Release Notes
References () https://security.snyk.io/vuln/SNYK-JS-CODESERVER-3368148 - Patch () https://security.snyk.io/vuln/SNYK-JS-CODESERVER-3368148 - Patch

27 Mar 2023, 16:14

Type Values Removed Values Added
CWE CWE-346
CPE cpe:2.3:a:coder:code-server:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.3
First Time Coder
Coder code-server
References (MISC) https://security.snyk.io/vuln/SNYK-JS-CODESERVER-3368148 - (MISC) https://security.snyk.io/vuln/SNYK-JS-CODESERVER-3368148 - Patch
References (MISC) https://github.com/coder/code-server/commit/d477972c68fc8c8e8d610aa7287db87ba90e55c7 - (MISC) https://github.com/coder/code-server/commit/d477972c68fc8c8e8d610aa7287db87ba90e55c7 - Patch
References (MISC) https://github.com/coder/code-server/releases/tag/v4.10.1 - (MISC) https://github.com/coder/code-server/releases/tag/v4.10.1 - Release Notes

23 Mar 2023, 05:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-03-23 05:15

Updated : 2025-02-25 20:15

NVD link : CVE-2023-26114

Mitre link : CVE-2023-26114

CVE.ORG link : CVE-2023-26114

JSON object : View

Products Affected

coder

  • code-server
CWE
CWE-1385

Missing Origin Validation in WebSockets

CWE-346

Origin Validation Error