CVE-2020-14368

CVE-2020-14368 is a Cross-Site Request Forgery (CSRF) vulnerability affecting Eclipse Che versions prior to 7.14.0, specifically impacting CodeReady Workspaces configured with cookie authentication. The flaw stems from improper SameSite cookie settings in Theia IDE, enabling a cross-site WebSocket hijack. An attacker can gain full access to a victim's workspace by conducting a Man-in-the-middle (MITM) attack and tricking the victim into clicking a malicious link. This vulnerability is rated High severity (CVSS 7.1), with a network attack vector and high attack complexity requiring user interaction. Its potential impact is high across confidentiality, integrity, and availability of the affected system. Currently, there is no evidence of active exploitation, and no public exploit code is available in Metasploit, Nuclei, or ExploitDB. The vulnerability has received minimal community discussion and media coverage, suggesting low public awareness.