{
"id": "GHSA-cf66-xwfp-gvc4",
"aliases": [
"CVE-2018-14732"
],
"details": "Versions of `webpack-dev-server` before 3.1.10 are missing origin validation on the websocket server. This vulnerability allows a remote attacker to steal a developer's source code because the origin of requests to the websocket server that is used for Hot Module Replacement (HMR) are not validated.\n\n\n## Recommendation\nFor `webpack-dev-server` update to version 3.1.11 or later.",
"summary": "Missing Origin Validation in webpack-dev-server",
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.1.11"
}
]
}
],
"package": {
"name": "webpack-dev-server",
"ecosystem": "npm"
}
}
],
"modified": "2022-04-06T20:39:38Z",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"published": "2019-01-04T17:40:59Z",
"references": [
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14732",
"type": "ADVISORY"
},
{
"url": "https://github.com/webpack/webpack-dev-server/issues/1445",
"type": "WEB"
},
{
"url": "https://github.com/webpack/webpack-dev-server/issues/1620",
"type": "WEB"
},
{
"url": "https://github.com/webpack/webpack-dev-server/commit/f18e5adf123221a1015be63e1ca2491ca45b8d10",
"type": "WEB"
},
{
"url": "https://github.com/webpack/webpack-dev-server",
"type": "PACKAGE"
},
{
"url": "https://github.com/webpack/webpack-dev-server/blob/master/CHANGELOG.md#3111-2018-12-21",
"type": "WEB"
},
{
"url": "https://www.npmjs.com/advisories/725",
"type": "WEB"
}
],
"schema_version": "1.4.0",
"database_specific": {
"cwe_ids": [
"CWE-20"
],
"severity": "HIGH",
"github_reviewed": true,
"nvd_published_at": null,
"github_reviewed_at": "2020-06-16T21:31:15Z"
}
}