CVE-2018-14732: Input Validation

Q: What is the severity of CVE-2018-14732?

CVE-2018-14732 is considered a medium severity vulnerability.

Q: How do I fix CVE-2018-14732?

To fix CVE-2018-14732, upgrade webpack-dev-server to version 3.1.6 or later.

Q: What types of software are affected by CVE-2018-14732?

CVE-2018-14732 affects versions of webpack-dev-server prior to 3.1.6.

Q: What is the impact of CVE-2018-14732?

The impact of CVE-2018-14732 allows attackers to potentially steal developer's code via unverified WebSocket connections.

Q: Who can exploit CVE-2018-14732?

Any attacker on the same network can exploit CVE-2018-14732 due to the lack of origin checks on WebSocket requests.

Published Sep 21, 2018

Updated

An issue was discovered in lib/Server.js in webpack-dev-server before 3.1.6. Attackers are able to steal developer's code because the origin of requests is not checked by the WebSocket server, which is used for HMR (Hot Module Replacement). Anyone can receive the HMR message sent by the WebSocket server via a ws://127.0.0.1:8080/ connection from any origin.

Affected Software

1 affected component

webpack.js webpack-dev-server<3.1.6

Remediation

Patch Available

https://github.com/webpack/webpack-dev-server/commit/f18e5adf123221a1015be63e1ca2491ca45b8d10

Event History

Sep 21, 2018

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2018-14732?

CVE-2018-14732 is considered a medium severity vulnerability.

How do I fix CVE-2018-14732?