Awaiting Analysis
CVE has been recently published to the CVE List and has been received by the NVD.

Products

github.com/gitpod-io/gitpod/components/server/go/pkg/lib

before main-gha.27122

github.com/gitpod-io/gitpod/components/ws-proxy/pkg/proxy

before main-gha.27122

github.com/gitpod-io/gitpod/install/installer/pkg/components/auth

before main-gha.27122

github.com/gitpod-io/gitpod/install/installer/pkg/components/public-api-server

before main-gha.27122

github.com/gitpod-io/gitpod/install/installer/pkg/components/server

before main-gha.27122

@gitpod/gitpod-protocol

before 0.1.5-main-gha.27122

Source

report@snyk.io

CVE-2024-21583 details

Published : July 19, 2024, 5:15 a.m.
Last Modified : July 19, 2024, 1:01 p.m.

Description

Versions of the package github.com/gitpod-io/gitpod/components/server/go/pkg/lib before main-gha.27122; versions of the package github.com/gitpod-io/gitpod/components/ws-proxy/pkg/proxy before main-gha.27122; versions of the package github.com/gitpod-io/gitpod/install/installer/pkg/components/auth before main-gha.27122; versions of the package github.com/gitpod-io/gitpod/install/installer/pkg/components/public-api-server before main-gha.27122; versions of the package github.com/gitpod-io/gitpod/install/installer/pkg/components/server before main-gha.27122; versions of the package @gitpod/gitpod-protocol before 0.1.5-main-gha.27122 are vulnerable to Cookie Tossing due to a missing __Host- prefix on the _gitpod_io_jwt2_ session cookie. This allows an adversary who controls a subdomain to set the value of the cookie on the Gitpod control plane, which can be assigned to an attacker’s own JWT so that specific actions taken by the victim (such as connecting a new Github organization) are actioned by the attackers session.

CVSS Score

1	2	3	4.1	5	6	7	8	9	10

Weakness

Weakness	Name	Description
CWE-15	External Control of System or Configuration Setting	One or more system settings or configuration elements can be externally controlled by a user.

CVSS Data

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

Base Score

4.1

Exploitability Score

2.3

Impact Score

1.4

Base Severity

MEDIUM

Vector String : CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N

References

URL	Source
https://app.safebase.io/portal/71ccd717-aa2d-4a1e-942e-c768d37e9e0c/preview?product=%5B%E2%80%A6%5D942e-c768d37e9e0c&tcuUid=1d505bda-9a38-4ca5-8724-052e6337f34d	report@snyk.io
https://github.com/gitpod-io/gitpod/commit/da1053e1013f27a56e6d3533aa251dbd241d0155	report@snyk.io
https://github.com/gitpod-io/gitpod/pull/19973	report@snyk.io
https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGITPODIOGITPODCOMPONENTSSERVERGOPKGLIB-7452074	report@snyk.io
https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGITPODIOGITPODCOMPONENTSWSPROXYPKGPROXY-7452075	report@snyk.io
https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGITPODIOGITPODINSTALLINSTALLERPKGCOMPONENTSAUTH-7452076	report@snyk.io
https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGITPODIOGITPODINSTALLINSTALLERPKGCOMPONENTSPUBLICAPISERVER-7452077	report@snyk.io
https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGITPODIOGITPODINSTALLINSTALLERPKGCOMPONENTSSERVER-7452078	report@snyk.io
https://security.snyk.io/vuln/SNYK-JS-GITPODGITPODPROTOCOL-7452079	report@snyk.io

This website uses the NVD API, but is not approved or certified by it.

CVE-2024-21583