CVE-2023-2848: Origin Validation Error

September 14, 2023 (updated September 20, 2023)

Movim prior to version 0.22 is affected by a Cross-Site WebSocket Hijacking vulnerability. This was the result of a missing header validation.

References

github.com/movim/movim/commit/49e2012aecdf918bb1d16f278fa9ff42fad29a9d
github.com/movim/movim/commit/96372082acd3e5d778a2522a60a1805bf2af31f6
mov.im/node/pubsub.movim.eu/Movim/a2d05925-0427-4f3f-b777-d20571ddddff
nvd.nist.gov/vuln/detail/CVE-2023-2848

Code Behaviors & Features

Detect and mitigate CVE-2023-2848 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →