TI-2023-00908 Aliases CVE-2023-0957 GHSA-f53g-frr2-jhpf

Origin validation error in Gitpod

MEDIUM 43CWE-1385Published 2023-03-03 · Updated 2025-03-05

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-346.

Summary

An issue was discovered in Gitpod versions prior to release-2022.11.2.16. There is a Cross-Site WebSocket Hijacking (CSWSH) vulnerability that allows attackers to make WebSocket connections to the Gitpod JSONRPC server using a victim’s credentials, because the Origin header is not restricted. This can lead to the extraction of data from workspaces, to a full takeover of the workspace.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00416 36th percentileScored 2026-11-07

Fix Fixed Gitpod (Gitpod): 2022.11.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Gitpod	Gitpod	before 2022.11.2	2022.11.2	Patch available	CNA

Gitpod VendorGitpod Affected before 2022.11.2 Fixed in 2022.11.2 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:gitpod:gitpod::::::::	before 2022.11.2	Vulnerable	Gitpod

cpe:2.3:a:gitpod:gitpod:*:*:*:*:*:*:*:* Versions before 2022.11.2 Vulnerable ·Gitpod

Remediation

Fix · CNA Gitpod (Gitpod) Fixed in 2022.11.2

Timeline

2026-10-02 Threatist record created from CVE-2023-0957
2026-10-03 Alias added: GHSA-f53g-frr2-jhpf

References

Patch 4

Advisory 1

https://app.safebase.io/portal/71ccd717-aa2d-4a1e-942e-c768d37e9e0c/preview?product=default&orgId=71ccd717-aa2d-4a1e-942e-c768d37e9e0c&tcuUid=1d505bda-9a38-4ca5-8724-052e6337f34d

Other 1

https://github.com/gitpod-io/gitpod/releases/tag/release-2022.11.2

TI-2021-14100 Gitpod before 0.6.0 allows unvalidated redirects. CVSS 3.1MEDIUM 6.1
TI-2023-16031 Gitpod before 2022.11.3 allows XSS because redirection can occur for some protocols… CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences