CVE-2023-30856

CriticalCVSS 10.0/10Last modified Jun 17, 2026

Description

eDEX-UI is a science fiction terminal emulator. Versions 2.2.8 and prior are vulnerable to cross-site websocket hijacking. When running eDEX-UI and browsing the web, a malicious website can connect to eDEX's internal terminal control websocket, and send arbitrary commands to the shell. The project has been archived since 2021, and as of time of publication there are no plans to patch this issue and release a new version. Some workarounds are available, including shutting down eDEX-UI when browsing the web and ensuring the eDEX terminal runs with lowest possible privileges.

Metrics

CVSS 3.1 10.0/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-346 CWE-1385

Affected software

No affected versions have been published.

Timeline

Published: Apr 28, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-308573.7@aedart/support is the support package for Ion, a monorepo for JavaScript/TypeScript packages. Prior to version `0.6.1`, there is a possible CVE-2023-308587.5The Denosaurs emoji package provides emojis for dinosaurs. Starting in version 0.1.0 and prior to version 0.3.0, the reTrimSpace regex has 2 CVE-2023-308599.8Triton is a Minecraft plugin for Spigot and BungeeCord that helps you translate your Minecraft server. The CustomPayload packet allows you t CVE-2023-30869.0Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.CVE-2023-308605.4WWBN AVideo is an open source video platform. In AVideo prior to version 12.4, a normal user can make a Meeting Schedule where the user can CVE-2023-308617.5Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for CVE-2023-308637.8In Connectivity Service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional e CVE-2023-308647.8In Connectivity Service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional e CVE-2023-308655.5In dialer service, there is a missing permission check. This could lead to local information disclosure with no additional execution privile CVE-2023-308665.5In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution priv CVE-2023-308674.9In the Streampark platform, when users log in to the system and use certain features, some pages provide a name-based fuzzy search, such as CVE-2023-308686.1Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Jon Christopher CMS Tree Page View plugin <= 1.6.7 versions.