Lucene search
GitHub Advisory DatabaseGHSA-JCR6-MMJJ-PCHWHistoryDec 28, 2022 - 12:30 a.m.
gorilla/handlers may allow requester to bypass expected behavior of the Same Origin Policy
2022-12-2800:30:23
CWE-346
GitHub Advisory Database
github.com
13
gorilla
handlers
same origin policy
cors
headers
access control
CVSS3
9.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
0.002
Percentile
54.8%
Usage of the CORS handler may apply improper CORS headers, allowing the requester to explicitly control the value of the Access-Control-Allow-Origin header, which bypasses the expected behavior of the Same Origin Policy.
Affected configurations
Node
gorillaschemaRange<1.3.0
Related
osv
osv
CVE-2017-20146
2022-12-27 22:15:11
Improper access control in github.com/gorilla/handlers
2021-04-14 20:04:52
nvd
nvd
CVE-2017-20146
2022-12-27 22:15:11
prion
prion
Design/Logic Flaw
2022-12-27 22:15:00
cvelist
cvelist
CVE-2017-20146 Improper access control in github.com/gorilla/handlers
2022-12-27 21:13:00
cve
cve
CVE-2017-20146
2022-12-27 22:15:11
debiancve
debiancve
CVE-2017-20146
2022-12-27 22:15:11
ubuntucve
ubuntucve
CVE-2017-20146
2022-12-27 00:00:00
veracode
veracode
Authorization Bypass
2023-01-12 09:37:28
redhatcve
redhatcve
CVE-2017-20146
2023-01-04 20:35:12
CVSS3
9.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
0.002
Percentile
54.8%
Related for GHSA-JCR6-MMJJ-PCHW