What is CVE-2023-26114?

CVE-2023-26114 is a high-severity vulnerability in Coder Code-server, classified under CWE-1385. CVSS score: 8.2/10. Published 2023-03-23.

How severe is CVE-2023-26114?

High severity. CVSS v3 base score is 8.2 out of 10.

Vulnerability in Coder Code-server

CVE-2023-26114

Versions of the package code-server before 4.10.1 are vulnerable to Missing Origin Validation in WebSockets handshakes. Exploiting this vulnerability can allow an adversary in specific scenarios to access data from and connect to the code-…

EPSS: 0.003 (26.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.2 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:L.

Affected products

Coder Code-server
N/a Code-server — versions 0

Weakness classification (CWE)

CWE-1385
CWE-346 — Origin Validation Error

References

report@snyk.io (Patch)
report@snyk.io (Patch)
report@snyk.io (Release Notes)

Frequently asked questions

What is CVE-2023-26114?: CVE-2023-26114 is a high-severity vulnerability in Coder Code-server, classified under CWE-1385. CVSS score: 8.2/10. Published 2023-03-23.
How severe is CVE-2023-26114?: High severity. CVSS v3 base score is 8.2 out of 10.