CVE-2023-0957
High
Description
An issue was discovered in Gitpod versions prior to release-2022.11.2.16. There is a Cross-Site WebSocket Hijacking (CSWSH) vulnerability that allows attackers to make WebSocket connections to the Gitpod JSONRPC server using a victim’s credentials, because the Origin header is not restricted. This can lead to the extraction of data from workspaces, to a full takeover of the workspace.
SeverityHigh
CVSS8.2
Exploit probability—
ProductGitpod
PublishedMar 3, 2023
First seenMar 3, 2023
Weakness typeCWE-1385CWE-1385
How to fix
Update
- gitpod gitpod2022.11.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| gitpod gitpod | v < 2022.11.2 | 2022.11.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.