Gitpod vulnerable to Cross-site Scripting

MEDIO 6.1CVE-2023-32766 · GHSA-gqx9-h3w2-fprg · Published 05/06/2023 · updated 17/06/2026

In breve

CVE-2023-32766 è una vulnerabilità MEDIO (CVSS 6.1) che riguarda github.com/gitpod-io/gitpod, gitpod (gitpod).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.56%, superiore al 46.5% delle vulnerabilità.
Correzione: aggiornare a 2022.11.3 o successiva.

Package	Affected versions	Patched versions
github.com/gitpod-io/gitpod Go	`< 2022.11.3`	`2022.11.3`
gitpod gitpod	`< 2022.11.3`	`2022.11.3`

Description

Gitpod before 2022.11.3 allows XSS because redirection can occur for some protocols outside of the trusted set of three (vscode: vscode-insiders: jetbrains-gateway:).

NVD description

Gitpod before 2022.11.3 allows XSS because redirection can occur for some protocols outside of the trusted set of three (vscode: vscode-insiders: jetbrains-gateway:).

References

nvd.nist.gov/vuln/detail/CVE-2023-32766 · ADVISORY
gitpod-io/gitpod#17559 · WEB
gitpod-io/gitpod commit 6771283 · WEB
app.safebase.io/portal/71ccd717-aa2d-4a1e-942e-c768d37e9e0c/preview · WEB
gitpod-io/gitpod · PACKAGE
gitpod-io/gitpod · WEB
gitpod-io/gitpod release 2022.11.3 · WEB
gitpod.io · WEB

Altre vulnerabilità di github.com/gitpod-io/gitpod

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free