GSA_kwCzR0hTQS05MjdoLXg0cWotcjI0Ms4AAUL4

Moderate EPSS: 0.00155% (0.37372 Percentile) EPSS:

Permalink JSON

github.com/gofiber/fiber/v2 vulnerable to Origin Validation Error

Affected Packages	Affected Versions	Fixed Versions
go:github.com/rs/cors	< 1.5.0	1.5.0
11,242 Dependent packages 27,043 Dependent repositories Affected Version Ranges All affected versions 1.3.0, 1.4.0 All unaffected versions 1.5.0, 1.6.0, 1.7.0, 1.8.0, 1.8.1, 1.8.2, 1.8.3, 1.9.0, 1.10.0, 1.10.1, 1.11.0, 1.11.1
go:github.com/gofiber/fiber/v2	>= 2.0.0, < 2.43.0	2.43.0
5,791 Dependent packages 5,223 Dependent repositories Affected Version Ranges All affected versions 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, 2.0.6, 2.1.0, 2.1.1, 2.1.2, 2.1.3, 2.1.4, 2.2.0, 2.2.1, 2.2.2, 2.2.3, 2.2.4, 2.2.5, 2.3.0, 2.3.1, 2.3.2, 2.3.3, 2.4.0, 2.4.1, 2.5.0, 2.6.0, 2.7.0, 2.7.1, 2.8.0, 2.9.0, 2.10.0, 2.11.0, 2.12.0, 2.13.0, 2.14.0, 2.15.0, 2.16.0, 2.17.0, 2.18.0, 2.19.0, 2.20.0, 2.20.1, 2.20.2, 2.21.0, 2.22.0, 2.23.0, 2.24.0, 2.25.0, 2.26.0, 2.27.0, 2.28.0, 2.29.0, 2.30.0, 2.31.0, 2.32.0, 2.33.0, 2.34.0, 2.34.1, 2.35.0, 2.36.0, 2.37.0, 2.37.1, 2.38.0, 2.38.1, 2.39.0, 2.40.0, 2.40.1, 2.41.0, 2.42.0 All unaffected versions 2.43.0, 2.44.0, 2.45.0, 2.46.0, 2.47.0, 2.48.0, 2.49.0, 2.49.1, 2.49.2, 2.50.0, 2.51.0, 2.52.0, 2.52.1, 2.52.2, 2.52.3, 2.52.4, 2.52.5, 2.52.6, 2.52.7, 2.52.8, 2.52.9

The Olivier Poitrey Go CORS handler through 1.3.0 actively converts a wildcard CORS policy into reflecting an arbitrary Origin header value, which is incompatible with the CORS security design, and could lead to CORS misconfiguration security problems.

References:

Identifiers

GHSA-927h-x4qj-r242

CVE-2018-20744

Risk

Severity

Moderate

EPSS

EPSS Percentage: 0.00155

EPSS Percentile: 0.37372

Classification

General

Source

GitHub Advisory Database

Origin

Unspecified

Repository

https://github.com/rs/cors

Date and time

Published

about 3 years ago

Updated

about 1 year ago

API

JSON

ecosyste.ms

Data

Tools

Indexes

Applications

Experiments

Advisories