CVE-2023-26114
Last modified
CVE-2023-26114 is a critical-severity vulnerability rated 9.3/10 on the CVSS scale. Versions of the package code-server before 4.10.1 are vulnerable to Missing Origin Validation in WebSockets handshakes. Exploiting this vulnerability can allow an adversary in specific scenarios to access data from and connect to the code-server instance.. EPSS estimates a 0.34% chance of exploitation in the next 30 days.
Description
Versions of the package code-server before 4.10.1 are vulnerable to Missing Origin Validation in WebSockets handshakes. Exploiting this vulnerability can allow an adversary in specific scenarios to access data from and connect to the code-server instance.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Coder | Code-Server | < 4.10.1 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-26114?
How severe is CVE-2023-26114?
How do I fix CVE-2023-26114?
How Strix Helps
- Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-26109All versions of the package node-bluetooth-serial-port are v…9.8
- CVE-2023-2611Advantech R-SeeNet versions 2.4.22 is installed with a hi…9.8
- CVE-2023-26110All versions of the package node-bluetooth are vulnerable to…9.8
- CVE-2023-26111All versions of the package @nubosoftware/node-static; all v…7.5
- CVE-2023-26112All versions of the package configobj are vulnerable to Regu…5.9
- CVE-2023-26113Versions of the package collection.js before 6.8.1 are vulne…7.5
- CVE-2023-26115All versions of the package word-wrap are vulnerable to Regu…7.5
- CVE-2023-26116Versions of the package angular from 1.2.21 are vulnerable t…5.3
- CVE-2023-26117Versions of the package angular from 1.0.0 are vulnerable to…5.3
- CVE-2023-26118Versions of the package angular from 1.4.9 are vulnerable to…5.3
- CVE-2023-26119Versions of the package net.sourceforge.htmlunit:htmlunit fr…9.8
- CVE-2023-2612Jean-Baptiste Cayrou discovered that the shiftfs file system…4.7
Are you affected by CVE-2023-26114?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST