CVE-2023-26114: Critical severity coder code-server vulnerability
Published Mar 23, 2023
·Updated
Versions of the package code-server before 4.10.1 are vulnerable to Missing Origin Validation in WebSockets handshakes. Exploiting this vulnerability can allow an adversary in specific scenarios to access data from and connect to the code-server instance.
Affected Software
1 affected component
Coder Code-Server<4.10.1
Remediation
Patch Available
Event History
Mar 23, 2023
CVE Published
via MITRE·05:00 AM
Data Sourced
via MITRE·05:00 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the vulnerability ID for code-server?
The vulnerability ID for code-server is CVE-2023-26114.
2
What is the severity of CVE-2023-26114?
The severity of CVE-2023-26114 is critical with a score of 9.3.
3
What is the affected software for CVE-2023-26114?
The affected software for CVE-2023-26114 is code-server versions before 4.10.1.
4
What is the CWE ID for CVE-2023-26114?
The CWE ID for CVE-2023-26114 is 346.
5
How can I fix the vulnerability in code-server?
To fix the vulnerability in code-server, update to version 4.10.1 or later.