← Back

CVE-2023-26114

nvd nist
Published: Mar 23, 2023Modified: Jun 17, 2026

JSON object

Loading...
9.3
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Exploitability: 2.8 / Impact: 5.8
Source: NVD

Description

Versions of the package code-server before 4.10.1 are vulnerable to Missing Origin Validation in WebSockets handshakes. Exploiting this vulnerability can allow an adversary in specific scenarios to access data from and connect to the code-server instance.

Affected (1)

Products: Coder: Code Server
Coder
1 product
Code Server
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Code Server
Before 4.10.1

Related CWEs

CWE-1385
Missing Origin Validation in WebSockets
The product uses a WebSocket, but it does not properly verify that the source of data or communication is valid.
CWE-346
Origin Validation Error
The product does not properly verify that the source of data or communication is valid.

References (6)

Source: report@snyk.io
Patch
Source: report@snyk.io
Release Notes
Source: report@snyk.io
Patch
Source: af854a3a-2127-422b-91ae-364da2661108
Patch
Source: af854a3a-2127-422b-91ae-364da2661108
Release Notes
Source: af854a3a-2127-422b-91ae-364da2661108
Patch

Timeline

No history available yet.