Missing Origin Validation in WebSockets
CVE-2024-23168
Summary
Vulnerability in Xiexe XSOverlay before build 647 allows non-local websites to send the malicious commands to the WebSocket API, resulting in the arbitrary code execution.
- LOW
- NETWORK
- HIGH
- UNCHANGED
- NONE
- NONE
- HIGH
- HIGH
CWE-1385 - Missing Origin Validation in WebSockets
The software uses a WebSocket, but it does not properly verify that the source of data or communication is valid.
References
Advisory Timeline
- Published
