CVE-2023-0957CWE-1385

An issue was discovered in Gitpod versions prior to release-2022.11.2.16

High · published March 3, 2023

CVSS v3.1
8.2
EPSS
0%
Percentile
34.5
In the wild
Unconfirmed
What it is

An issue was discovered in Gitpod versions prior to release-2022.11.2.16. There is a Cross-Site WebSocket Hijacking (CSWSH) vulnerability that allows attackers to make WebSocket connections to the Gitpod JSONRPC server using a victim’s credentials, because the Origin header is not restricted. This can lead to the extraction of data from workspaces, to a full takeover of the workspace.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00413 · 34.5th percentile
Weakness
CWE-1385 · Missing Origin Validation in WebSockets
Published
2023-03-03T07:00Z
EPSS history
Timeline
  • 03 MAR 07:00Z
    An issue was discovered in Gitpod versions prior to release-2022.11.2.16
    cvelistv5