CVE-2017-20146

2022-12-2722:15:11

CWE-346

web.nvd.nist.gov

115

cve-2017-20146

cors

same origin policy

nvd

security vulnerability

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.3

Confidence

High

EPSS

0.002

Percentile

59.6%

JSON

Usage of the CORS handler may apply improper CORS headers, allowing the requester to explicitly control the value of the Access-Control-Allow-Origin header, which bypasses the expected behavior of the Same Origin Policy.

Affected configurations

Nvd

Node

gorillatoolkithandlersRange<1.3.0go

CNA Affected

[
  {
    "vendor": "github.com/gorilla/handlers",
    "product": "github.com/gorilla/handlers",
    "collectionURL": "https://pkg.go.dev",
    "packageName": "github.com/gorilla/handlers",
    "versions": [
      {
        "version": "0",
        "lessThan": "1.3.0",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "programRoutines": [
      {
        "name": "cors.ServeHTTP"
      }
    ],
    "defaultStatus": "unaffected"
  }
]