lukehutch Gribbit HttpRequestHandler.java messageReceived missing origin validation in websockets

EntryHistoryDiffjsonxmlCTI

A vulnerability was found in lukehutch Gribbit. It has been classified as problematic. Affected is the function messageReceived of the file src/gribbit/request/HttpRequestHandler.java. The manipulation leads to missing origin validation in websockets. Using CWE to declare the problem leads to CWE-1385. The weakness was released 01/09/2023 as 620418df247aebda3dd4be1dda10fe229ea505dd. The advisory is shared for download at github.com. This vulnerability is traded as CVE-2014-125071. The attack can only be initiated within the local network. Technical details are available. There is no exploit available. The current price for an exploit might be approx. USD $0-$5k at the moment. It is declared as not defined. As 0-day the estimated underground price was around $0-$5k. The name of the patch is 620418df247aebda3dd4be1dda10fe229ea505dd. The bugfix is ready for download at github.com. It is recommended to apply a patch to fix this issue. A possible mitigation has been published even before and not after the disclosure of the vulnerability.

Timeline

The analysis of the timeline helps to identify the required approach and handling of single vulnerabilities and vulnerability collections. This overview makes it possible to see less important slices and more severe hotspots at a glance. Initiating immediate vulnerability response and prioritizing of issues is possible.

User

1	23

Field

source_cve_nvd_summary	1
source_cve_assigned	1
exploit_price_0day	1
vulnerability_cvss3_meta_tempscore	1
vulnerability_cvss3_meta_basescore	1

Commit Conf

90%	29
50%	13
70%	2

Approve Conf

90%	29
80%	13
70%	2

ID	Commited	User	Field	Change	Remarks	Accepted	Status	C
13612788	01/30/2023	VulD...	cve_nvd_summary	A vulnerability was found in lukehutch Gribbit. It has been classified as problematic. Affected is the function messageReceived of the file src/gribbit/request/HttpRequestHandler.java. The manipulation leads to missing origin validation in websockets. The name of the patch is 620418df247aebda3dd4be1dda10fe229ea505dd. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217716.	cve.mitre.org	01/30/2023	accepted	70
13612787	01/30/2023	VulD...	cve_assigned	1673218800 (01/09/2023)	cve.mitre.org	01/30/2023	accepted	70
13498694	01/09/2023	VulD...	price_0day	$0-$5k	see exploit price documentation	01/09/2023	accepted	90
13498693	01/09/2023	VulD...	cvss3_meta_tempscore	5.3	see CVSS documentation	01/09/2023	accepted	90
13498692	01/09/2023	VulD...	cvss3_meta_basescore	5.5	see CVSS documentation	01/09/2023	accepted	90
13498691	01/09/2023	VulD...	cvss3_vuldb_tempscore	5.3	see CVSS documentation	01/09/2023	accepted	90
13498690	01/09/2023	VulD...	cvss3_vuldb_basescore	5.5	see CVSS documentation	01/09/2023	accepted	90
13498689	01/09/2023	VulD...	cvss2_vuldb_tempscore	4.5	see CVSS documentation	01/09/2023	accepted	90
13498688	01/09/2023	VulD...	cvss2_vuldb_basescore	5.2	see CVSS documentation	01/09/2023	accepted	90
13498687	01/09/2023	VulD...	cvss3_vuldb_e	X	derived from historical data	01/09/2023	accepted	80
13498686	01/09/2023	VulD...	cvss3_vuldb_ui	N	derived from historical data	01/09/2023	accepted	80
13498685	01/09/2023	VulD...	cvss3_vuldb_pr	L	derived from historical data	01/09/2023	accepted	80
13498684	01/09/2023	VulD...	cvss3_vuldb_av	A	derived from historical data	01/09/2023	accepted	80
13498683	01/09/2023	VulD...	cvss2_vuldb_e	ND	derived from historical data	01/09/2023	accepted	80
13498682	01/09/2023	VulD...	cvss2_vuldb_au	S	derived from historical data	01/09/2023	accepted	80
13498681	01/09/2023	VulD...	cvss2_vuldb_av	A	derived from historical data	01/09/2023	accepted	80
13498680	01/09/2023	VulD...	cvss2_vuldb_rl	OF	derived from vuldb v3 vector	01/09/2023	accepted	80
13498679	01/09/2023	VulD...	cvss2_vuldb_rc	C	derived from vuldb v3 vector	01/09/2023	accepted	80
13498678	01/09/2023	VulD...	cvss2_vuldb_ai	P	derived from vuldb v3 vector	01/09/2023	accepted	80
13498677	01/09/2023	VulD...	cvss2_vuldb_ii	P	derived from vuldb v3 vector	01/09/2023	accepted	80

24 more entries are not shown

🔒 Login Required

You need to signup and login to see more of the remaining 24 results.

◂ Previous Overview Next ▸

Do you need the next level of professionalism?

Upgrade your account now!