Read the docs
TI-2020-11236 Aliases CVE-2020-14368GHSA-mcp4-jxrc-pg4f

Cross-site request forgery in eclipse

Priority LOW 32CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
High
Impact type
Tampering
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-352.

Summary

A flaw was found in Eclipse Che in versions prior to 7.14.0 that impacts CodeReady Workspaces. When configured with cookies authentication, Theia IDE doesn't properly set the SameSite value, allowing a Cross-Site Request Forgery (CSRF) and consequently allowing a cross-site WebSocket hijack on Theia IDE. This flaw allows an attacker to gain full access to the victim's workspace through the /services endpoint. To perform a successful attack, the attacker conducts a Man-in-the-middle attack (MITM) and tricks the victim into executing a request via an untrusted link, which performs the CSRF and the Socket hijack. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

Why it matters now

EPSS 0.00513 43rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—eclipseche-theia 7.14.0—No fix listedCNA
  • eclipse Vendor— Affected che-theia 7.14.0 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:eclipse:che:*:*:*:*:*:*:*:*before 7.14.0VulnerableEclipse Foundation
  • cpe:2.3:a:eclipse:che:*:*:*:*:*:*:*:* Versions before 7.14.0 Vulnerable ·Eclipse Foundation

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-14368
  2. 2026-10-03 Alias added: GHSA-mcp4-jxrc-pg4f

References

Advisory 1

  • TI-2019-13158 Cross-site request forgery in Eclipse Che CVSS 3.1HIGH 8.8
  • TI-2021-17898 The build of some language stacks of Eclipse Che version 6 includes pulling some binaries… CVSS 3.1HIGH 8.1
  • TI-2020-08592 Missing authorization in Red Hat Eclipse Che CVSS 3.1MEDIUM 6.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences