CVE-2023-0957

CRITICO 9.6CVE-2023-0957 · Published 03/03/2023 · updated 17/06/2026

In breve

CVE-2023-0957 è una vulnerabilità CRITICO (CVSS 9.6) che riguarda gitpod (gitpod).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.42%, superiore al 36.1% delle vulnerabilità.
Correzione: aggiornare a 2022.11.2 o successiva.

Package	Affected versions	Patched versions
gitpod gitpod	`< 2022.11.2`	`2022.11.2`

Description

An issue was discovered in Gitpod versions prior to release-2022.11.2.16. There is a Cross-Site WebSocket Hijacking (CSWSH) vulnerability that allows attackers to make WebSocket connections to the Gitpod JSONRPC server using a victim’s credentials, because the Origin header is not restricted. This can lead to the extraction of data from workspaces, to a full takeover of the workspace.

References

app.safebase.io/portal/71ccd717-aa2d-4a1e-942e-c768d37e9e0c/preview · Vendor Advisory
gitpod-io/gitpod commit 1295698 · Patch
gitpod-io/gitpod commit 673ab68 · Patch
gitpod-io/gitpod#16378 · Issue Tracking
gitpod-io/gitpod#16405 · Issue Tracking
gitpod-io/gitpod release release-2022.11.2 · Release Notes
snyk.io/blog/gitpod-remote-code-execution-vulnerability-websockets · Third Party Advisory

Altre vulnerabilità di gitpod

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

gitpod

< 2022.11.2

2022.11.2

Description