Gitpod vulnerable to Cross-site Scripting

MOYENNE 6.1CVE-2023-32766 · GHSA-gqx9-h3w2-fprg · Published 05/06/2023 · updated 17/06/2026

En bref

CVE-2023-32766 est une vulnérabilité MOYENNE (CVSS 6.1) touchant github.com/gitpod-io/gitpod, gitpod (gitpod).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.56%, plus élevée que 46.5% des vulnérabilités.
Correctif : mettre à jour vers 2022.11.3 ou plus récent.

Package	Affected versions	Patched versions
github.com/gitpod-io/gitpod Go	`< 2022.11.3`	`2022.11.3`
gitpod gitpod	`< 2022.11.3`	`2022.11.3`

Description

Gitpod before 2022.11.3 allows XSS because redirection can occur for some protocols outside of the trusted set of three (vscode: vscode-insiders: jetbrains-gateway:).

NVD description

Gitpod before 2022.11.3 allows XSS because redirection can occur for some protocols outside of the trusted set of three (vscode: vscode-insiders: jetbrains-gateway:).

References

nvd.nist.gov/vuln/detail/CVE-2023-32766 · ADVISORY
gitpod-io/gitpod#17559 · WEB
gitpod-io/gitpod commit 6771283 · WEB
app.safebase.io/portal/71ccd717-aa2d-4a1e-942e-c768d37e9e0c/preview · WEB
gitpod-io/gitpod · PACKAGE
gitpod-io/gitpod · WEB
gitpod-io/gitpod release 2022.11.3 · WEB
gitpod.io · WEB

Autres vulnérabilités de github.com/gitpod-io/gitpod

Tout voir →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

github.com/gitpod-io/gitpod

< 2022.11.3

2022.11.3

gitpod

< 2022.11.3

2022.11.3

Description

Gitpod before 2022.11.3 allows XSS because redirection can occur for some protocols outside of the trusted set of three (vscode: vscode-insiders: jetbrains-gateway:).

NVD description

Gitpod before 2022.11.3 allows XSS because redirection can occur for some protocols outside of the trusted set of three (vscode: vscode-insiders: jetbrains-gateway:).