CVE-2020-14368
mediumpriority · track · 38EPSS 0.005 · 44 %ileexploit · PoCEUUSEPSS · scored 2026-10-28
A flaw was found in Eclipse Che in versions prior to 7.14.0 that impacts CodeReady Workspaces. When configured with cookies authentication, Theia IDE doesn't properly set the SameSite value, allowing a Cross-Site Request Forgery (CSRF) and consequently allowing a cross-site WebSocket hijack on Theia IDE. This flaw allows an attacker to gain full access to the victim's workspace through the /services endpoint. To perform a successful attack, the attacker conducts a Man-in-the-middle attack (MITM) and tricks the victim into executing a request via an untrusted link, which performs the CSRF and the Socket hijack. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 4.6–7.1
weaknesses
The CWE weakness classes this flaw belongs to.
exploits (1)
Public proof-of-concept and weaponised exploit code.
- codingchili/CVE-2020-14368Interactive RCE exploit demo for Eclipse CHEPoC · poc_in_github
affected products (2)
Products and version ranges known to be affected.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (5)
External citations — patches, advisories, analysis.
- https://bugzilla.redhat.com/show_bug.cgi?id=1823892cnnvd
- https://bugzilla.redhat.com/show_bug.cgi?id=1875699Patchcnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2020-14368cnnvd
- https://bugzilla.redhat.com/show_bug.cgi?id=1823892enisa_euvd
- https://bugzilla.redhat.com/show_bug.cgi?id=1823892Issue TrackingThird Party Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan