PT-2018-12687
CVE-2018-14730
·
تاريخ النشر
2018-09-21
·
تاريخ التحديث
2020-09-01
الوصف من
CVSS 3.1
7.5
عاليةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions
browserify-hmr versions prior to 0.4.0
Description
An issue was discovered where the origin of requests is not checked by the WebSocket server used for Hot Module Replacement (HMR), allowing attackers to steal a developer's code. The WebSocket server, accessible via a ws://127.0.0.1:3123/ connection, does not validate the origin of requests, making it possible for anyone to receive HMR messages sent by the server from any origin.
Recommendations
Upgrade to version 0.4.0 or later.
As a temporary workaround, consider restricting access to the WebSocket server to minimize the risk of exploitation.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾