What is GHSA-frjg-g767-7363?

GHSA-frjg-g767-7363 is a security advisory published by GitHub Security Advisories with Critical severity. code-server vulnerable to Missing Origin Validation in WebSockets

Which CVE IDs does GHSA-frjg-g767-7363 cover?

GHSA-frjg-g767-7363 covers the following CVE IDs: CVE-2023-26114. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-frjg-g767-7363?

GHSA-frjg-g767-7363 has a CVSS v3 base score of 9.3, published by GitHub Security Advisories.

Which products are affected by GHSA-frjg-g767-7363?

GHSA-frjg-g767-7363 affects 1 product, including: npm/code-server:\u003c 4.10.1.

GHSA-frjg-g767-7363CriticalCVSS 9.3

code-server vulnerable to Missing Origin Validation in WebSockets

Vendor

GitHub Security Advisories

Published

March 23, 2023

Last Modified

March 27, 2023

🔗 CVE IDs covered (1)

CVE-2023-26114 →

📋 Description

Versions of the package code-server before 4.10.1 are vulnerable to Missing Origin Validation in WebSockets handshakes. Exploiting this vulnerability can allow an adversary in specific scenarios to access data from and connect to the code-server instance.

🎯 Affected products1

npm/code-server:< 4.10.1

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2023-26114
https://github.com/coder/code-server/commit/d477972c68fc8c8e8d610aa7287db87ba90e55c7
https://github.com/coder/code-server/releases/tag/v4.10.1
https://security.snyk.io/vuln/SNYK-JS-CODESERVER-3368148
https://github.com/advisories/GHSA-frjg-g767-7363