CVE-2023-2848

    Dashboard / Vulnerabilities / CVE-2023-2848

    CVE-2023-2848

    Published: 14 Sept 2023Last Modified: 12 Aug 2026

    Summary:

    Details: Movim prior to version 0.22 is affected by a Cross-Site WebSocket Hijacking vulnerability. This was the result of a missing header validation.

    References: https://mov.im/node/pubsub.movim.eu/Movim/a2d05925-0427-4f3f-b777-d20571ddddff, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/2xxx/CVE-2023-2848.json, https://nvd.nist.gov/vuln/detail/CVE-2023-2848, https://github.com/movim/movim/commit/49e2012aecdf918bb1d16f278fa9ff42fad29a9d, https://github.com/movim/movim/commit/96372082acd3e5d778a2522a60a1805bf2af31f6

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -d165bd6ee4121ec7a760b6669fd3e324942b4f2a

    Affected versions

    v0.21.1
    v0.21

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-2848 | CVE-DB