CVE-2020-14368
- Source
- https://cve.org/CVERecord?id=CVE-2020-14368
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-14368.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2020-14368
- Published
- 2020-12-14T21:15:18Z
- Modified
- 2026-08-27T08:40:49Z
- Severity
-
- 7.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
A flaw was found in Eclipse Che in versions prior to 7.14.0 that impacts CodeReady Workspaces. When configured with cookies authentication, Theia IDE doesn't properly set the SameSite value, allowing a Cross-Site Request Forgery (CSRF) and consequently allowing a cross-site WebSocket hijack on Theia IDE. This flaw allows an attacker to gain full access to the victim's workspace through the /services endpoint. To perform a successful attack, the attacker conducts a Man-in-the-middle attack (MITM) and tricks the victim into executing a request via an untrusted link, which performs the CSRF and the Socket hijack. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
- References
Affected packages
Git / github.com/eclipse-che/che
Affected ranges
- Type
- GIT
- Repo
- https://github.com/eclipse-che/che
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
- Database specific
-
Show details
{ "cpe": "cpe:2.3:a:eclipse:che:*:*:*:*:*:*:*:*", "extracted_events": [ { "introduced": "0" }, { "fixed": "7.14.0" } ], "source": "CPE_RANGE" }
Affected versions
4.*
4.0.0
4.0.0-RC10
4.0.0-RC11
4.0.0-RC12
4.0.0-RC13
4.0.0-RC14
4.0.0-RC4
4.0.0-RC5
4.0.0-RC6
4.0.0-RC7
4.0.0-RC8
4.0.0-RC9
4.1.0
4.2.0
4.3.0
4.3.0-RC1
4.4.0
4.5.0
4.6.0
4.7.0
4.7.0-RC1
5.*
5.0.0
5.0.0-M1
5.0.0-M3
5.0.0-M5
5.0.0-M6
5.0.0-M7
5.0.0-M8
5.1.0
5.2.0
5.4.0
5.5.0
5.7.0
5.8.0
5.9.0
Other
Docker