GHSA-w6v7-w58j-pg5r

ghsaUSosv

Improper Verification of Communication Channel in @theia/plugin-ext

view advisory published 2021-11-15Licence: CC-BY-4.0

In versions of the @theia/plugin-ext component of Eclipse Theia prior to 1.18.0, Webview contents can be hijacked via postMessage().

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2021-41038US	medium6.1	0.74% (54th)	—	2021-11-10
In versions of the @theia/plugin-ext component of Eclipse Theia prior to 1.18.0, Webview contents can be hijacked via postMessage().

External citations — patches, advisories, analysis.

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.