Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CVE-2020-14368

EPSS 0.09% · P26
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2020-14368

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Description
A flaw was found in Eclipse Che in versions prior to 7.14.0 that impacts CodeReady Workspaces. When configured with cookies authentication, Theia IDE doesn't properly set the SameSite value, allowing a Cross-Site Request Forgery (CSRF) and consequently allowing a cross-site WebSocket hijack on Theia IDE. This flaw allows an attacker to gain full access to the victim's workspace through the /services endpoint. To perform a successful attack, the attacker conducts a Man-in-the-middle attack (MITM) and tricks the victim into executing a request via an untrusted link, which performs the CSRF and the Socket hijack. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
跨站请求伪造(CSRF)
Source: NVD (National Vulnerability Database)
Vulnerability Title
Eclipse Che 跨站请求伪造漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Eclipse Che是Eclipse基金会的一套基于Java的开源在线集成开发环境（IDE）。 Eclipse Che 中存在跨站请求伪造漏洞。该漏洞源于WEB应用未充分验证请求是否来自可信用户。攻击者可利用该漏洞通过受影响客户端向服务器发送非预期的请求。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
-eclipse che-theia 7.14.0 -

II. Public POCs for CVE-2020-14368

#POC DescriptionSource LinkShenlong Link
1Interactive RCE exploit demo for Eclipse CHEhttps://github.com/codingchili/CVE-2020-14368POC Details
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2020-14368

请登录查看更多情报信息。

Same Patch Batch · n/a · 2020-12-14 · 56 CVEs total

CVE-2020-0444Google Android Pixel 安全漏洞
CVE-2020-35457GNOME Glib 输入验证错误漏洞
CVE-2020-0457Google Android 缓冲区错误漏洞
CVE-2020-0016Google Android Pixel 信任管理问题漏洞
CVE-2020-0456Google Android 缓冲区错误漏洞
CVE-2020-0455Google Android Pixel 缓冲区错误漏洞
CVE-2020-0019Google Android Pixel 信任管理问题漏洞
CVE-2020-0458Google Android Pixel 输入验证错误漏洞
CVE-2020-0459Google Android 安全漏洞
CVE-2020-0468Google Android Pixel 安全漏洞
CVE-2020-0440Google Android 安全漏洞
CVE-2020-0464Google Android 安全漏洞
CVE-2020-0466Google Android资源管理错误漏洞
CVE-2020-0099Google Android 安全漏洞
CVE-2020-20189Ornose15 Newpk SQL注入漏洞
CVE-2020-20184Liftoff GateOne 输入验证错误漏洞
CVE-2020-29304WordPress 跨站脚本漏洞
CVE-2020-29303WordPress SabaiApps DirectoriesPro plugin 跨站脚本漏洞
CVE-2020-20183Zyxel P1302-T10 代码问题漏洞
CVE-2020-8177Haxx curl 注入漏洞

Showing top 20 of 56 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: eclipse
Same vendor: n/a
Same weakness: CWE-352

V. Comments for CVE-2020-14368

No comments yet

Leave a comment