GHSA-77q4-m83q-w76v

Suggest an improvement
Source
https://github.com/advisories/GHSA-77q4-m83q-w76v
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-77q4-m83q-w76v/GHSA-77q4-m83q-w76v.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-77q4-m83q-w76v
Aliases
  • CVE-2018-14730
Published
2020-09-01T21:18:20Z
Modified
2023-11-08T03:59:56.864154Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Missing Origin Validation in browserify-hmr
Details

Versions of browserify-hmr prior to 0.4.0 are missing origin validation on the websocket server.

This vulnerability allows a remote attacker to steal a developer's source code because the origin of requests to the websocket server that is used for Hot Module Replacement (HMR) are not validated.

Recommendation

Upgrade to version 0.4.0 or later.

Database specific 
{
    "cwe_ids": [
        "CWE-200"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-08-31T18:33:33Z",
    "nvd_published_at": null,
    "severity": "HIGH"
}
References

Affected packages

npm / browserify-hmr

Package

Name
browserify-hmr
View open source insights on deps.dev
Purl
pkg:npm/browserify-hmr

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.4.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-77q4-m83q-w76v/GHSA-77q4-m83q-w76v.json"