-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
GoGoMiggo AIRoot Cause AnalysisThe vulnerability stems from missing WebSocket authentication in the UI server. WebSocket handlers are typically implemented via connection handling functions (like HandleWebSocketConnection) and server initialization functions (like StartUIServer). The CWE-306 (Missing Authentication for Critical Function) directly maps to these functions as they would be responsible for enforcing authentication before allowing pod operations. The high confidence comes from: 1) The vulnerability's technical description explicitly mentions WebSocket auth lack 2) The fix in v4.14.0 would logically require modifying these core WebSocket handling components 3) Standard WebSocket implementation patterns in Go applications match this structure.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/loft-sh/devspace | go | <= 4.13.0 | 4.14.0 |