CVE-2023-32766

Gitpod before 2022.11.3 allows XSS because redirection can occur for some protocols outside of the trusted set of three (vscode: vscode-insiders: jetbrains-gateway:).

• CWE-79
• CWE-79

• https://app.safebase.io/portal/71ccd717-aa2d-4a1e-942e-c768d37e9e0c/preview?product=default&tcuUid=1d505bda-9a38-4ca5-8724-052e6337f34dThird Party Advisory
• https://github.com/gitpod-io/gitpod/commit/6771283c3406586e352337675b79ff2ca50f191bPatch
• https://github.com/gitpod-io/gitpod/compare/release-2022.11.2...2022.11.3Patch
• https://github.com/gitpod-io/gitpod/pull/17559Patch
• https://github.com/gitpod-io/gitpod/releases/tag/2022.11.3Release Notes
• https://www.gitpod.ioProduct
• https://app.safebase.io/portal/71ccd717-aa2d-4a1e-942e-c768d37e9e0c/preview?product=default&tcuUid=1d505bda-9a38-4ca5-8724-052e6337f34dThird Party Advisory
• https://github.com/gitpod-io/gitpod/commit/6771283c3406586e352337675b79ff2ca50f191bPatch
• https://github.com/gitpod-io/gitpod/compare/release-2022.11.2...2022.11.3Patch
• https://github.com/gitpod-io/gitpod/pull/17559Patch
• https://github.com/gitpod-io/gitpod/releases/tag/2022.11.3Release Notes
• https://www.gitpod.ioProduct

Published

Jun 5, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-3276A vulnerability, which was classified as problematic, has be…7.5
• CVE-2023-32760An issue in Archer Platform before v.6.13 fixed in v.6.12.0.…6.5
• CVE-2023-32761Cross Site Request Forgery (CSRF) vulnerability in Archer Pl…8
• CVE-2023-32762An issue was discovered in Qt before 5.15.14, 6.x before 6.2…5.3
• CVE-2023-32763An issue was discovered in Qt before 5.15.15, 6.x before 6.2…7.5
• CVE-2023-32764Fabasoft Cloud Enterprise Client 23.3.0.130 allows a user to…7.8
• CVE-2023-32767The web interface of Symcon IP-Symcon before 6.3 (i.e., befo…7.5
• CVE-2023-3277The MStore API plugin for WordPress is vulnerable to Unautho…9.8
• CVE-2023-32781A command injection vulnerability was identified in PRTG 23.…7.2
• CVE-2023-32782A command injection was identified in PRTG 23.2.84.1566 and …7.2
• CVE-2023-32783The event analysis component in Zoho ManageEngine ADAudit Pl…7.5
• CVE-2023-32784In KeePass 2.x before 2.54, it is possible to recover the cl…7.5