CVE-2020-14368

A flaw was found in Eclipse Che in versions prior to 7.14.0 that impacts CodeReady Workspaces. When configured with cookies authentication, Theia IDE doesn't properly set the SameSite value, allowing a Cross-Site Request Forgery (CSRF) and consequently allowing a cross-site WebSocket hijack on Theia IDE. This flaw allows an attacker to gain full access to the victim's workspace through the /services endpoint. To perform a successful attack, the attacker conducts a Man-in-the-middle attack (MITM) and tricks the victim into executing a request via an untrusted link, which performs the CSRF and the Socket hijack. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

• CWE-352

• https://bugzilla.redhat.com/show_bug.cgi?id=1823892Issue Tracking, Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1823892Issue Tracking, Third Party Advisory

Published

Dec 14, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-14362A flaw was found in X.Org Server before xorg-x11-server 1.20…7.8
• CVE-2020-14363An integer overflow vulnerability leading to a double-free w…7.8
• CVE-2020-14364An out-of-bounds read/write access flaw was found in the USB…5
• CVE-2020-14365A flaw was found in the Ansible Engine, in ansible-engine 2.…7.1
• CVE-2020-14366A vulnerability was found in keycloak, where path traversal …7.5
• CVE-2020-14367A flaw was found in chrony versions before 3.5.1 when creati…6
• CVE-2020-14369This release fixes a Cross Site Request Forgery vulnerabilit…6.3
• CVE-2020-1437An elevation of privilege vulnerability exists in the way th…7.8
• CVE-2020-14370An information disclosure vulnerability was found in contain…5.3
• CVE-2020-14371A credential leak vulnerability was found in Red Hat Satelli…6.5
• CVE-2020-14372A flaw was found in grub2 in versions prior to 2.06, where i…7.5
• CVE-2020-14373A use after free was found in igc_reloc_struct_ptr() of psi/…5.5