CVE-2020-10591

Walmart Labs Concord before 1.44.0 has an insecure CORS policy where Access-Control-Allow-Origin depends on Origin and is not configurable. This can allow remote attackers to discover host information, nodes, API metadata, and references to usernames via api/v1/apikey. Affected product version(s)...