CVE-2025-30360mediumCWE-346

CVE-2025-30360: falha de média gravidade em webpack-dev-server

webpack-dev-server users' source code may be stolen when they access a malicious web site with non-Chromium based browser

Publicada em

Seguir esta CVE+ Monitorar webpack-dev-server+ Monitorar webpack-dev-server

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.5epss 0.4%
webpack-dev-server allows users to use webpack with a development server that provides live reloading. Prior to version 5.2.1, webpack-dev-server users' source code may be stolen when you access a malicious web site with non-Chromium based browser. The `Origin` header is checked to prevent Cross-site WebSocket hijacking from happening, which was reported by CVE-2018-14732. But webpack-dev-server always allows IP address `Origin` headers. This allows websites that are served on IP addresses to connect WebSocket. An attacker can obtain source code via a method similar to that used to exploit CVE-2018-14732. Version 5.2.1 contains a patch for the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Produtos afetados
webpack · webpack-dev-server
CVEs relacionadas — webpack-dev-server

No mesmo produto, das mais perigosas para as menos.

CVE-2025-30359MEDIUMwebpack-dev-server users' source code may be stolen when they access a malicious web siteEPSS 0.6%