PT-2022-11652

CVE-2021-42648

Published

2022-05-11

Updated

2022-05-20

Description by

CVSS 3.1

6.1

Medium

MetricsAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Coder Code-Server versions prior to 3.12.0

Description A cross-site scripting (XSS) issue exists, allowing attackers to execute arbitrary code via a crafted URL. This enables the execution of malicious scripts, potentially leading to unauthorized actions on the affected system.

Recommendations For versions prior to 3.12.0, update to version 3.12.0 or later to resolve the issue. As a temporary workaround, consider restricting access to crafted URLs to minimize the risk of exploitation.

Exploitability

Exploit

Fix

Impacts

Researchers

Jyhtpyo

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers

CVE-2021-42648