Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-jcr6-mmjj-pchw

Опубликовано: 28 дек. 2022
Источник: github
Github: Прошло ревью
CVSS3: 9.8

Описание

gorilla/handlers may allow requester to bypass expected behavior of the Same Origin Policy

Usage of the CORS handler may apply improper CORS headers, allowing the requester to explicitly control the value of the Access-Control-Allow-Origin header, which bypasses the expected behavior of the Same Origin Policy.

Пакеты

Наименование

github.com/gorilla/handlers

go
Затронутые версииВерсия исправления

< 1.3.0

1.3.0

EPSS

Процентиль: 29%
0.00108
Низкий

9.8 Critical

CVSS3

Дефекты

CWE-346

Связанные уязвимости

CVSS3: 9.8
ubuntu
около 3 лет назад

Usage of the CORS handler may apply improper CORS headers, allowing the requester to explicitly control the value of the Access-Control-Allow-Origin header, which bypasses the expected behavior of the Same Origin Policy.

CVSS3: 7
redhat
около 3 лет назад

Usage of the CORS handler may apply improper CORS headers, allowing the requester to explicitly control the value of the Access-Control-Allow-Origin header, which bypasses the expected behavior of the Same Origin Policy.

CVSS3: 9.8
nvd
около 3 лет назад

Usage of the CORS handler may apply improper CORS headers, allowing the requester to explicitly control the value of the Access-Control-Allow-Origin header, which bypasses the expected behavior of the Same Origin Policy.

CVSS3: 9.8
debian
около 3 лет назад

Usage of the CORS handler may apply improper CORS headers, allowing th ...

EPSS

Процентиль: 29%
0.00108
Низкий

9.8 Critical

CVSS3

Дефекты

CWE-346