CVE-2023-30856

Katalog CVE

CVSS 10.0 · Critical EPSS 0,35%

Kerentanan Origin Validation Error pada edex-ui project edex-ui. Skor CVSS 3.1 10.0 (Critical) menurut NVD.

Deskripsi (NVD)

eDEX-UI is a science fiction terminal emulator. Versions 2.2.8 and prior are vulnerable to cross-site websocket hijacking. When running eDEX-UI and browsing the web, a malicious website can connect to eDEX's internal terminal control websocket, and send arbitrary commands to the shell. The project has been archived since 2021, and as of time of publication there are no plans to patch this issue and release a new version. Some workarounds are available, including shutting down eDEX-UI when browsing the web and ensuring the eDEX terminal runs with lowest possible privileges.

Rincian

Terbit di NVD

28 April 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

10.0 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-346: Origin Validation Error
CWE-1385: Missing Origin Validation in WebSockets

EPSS (30 hari)

0,35% peluang dieksploitasi; lebih tinggi dari 26,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/GitSquared/edex-ui/security/advisories/GHSA-q8xc-f2wf-ffh9 advisory vendor
• https://christian-schneider.net/CrossSiteWebSocketHijacking.html deskripsi teknis
• https://github.com/GitSquared/edex-ui/blob/04a00c4079908788b371c6ecdefff96d0d9950f8/src/classes/terminal.class... product