5.9

CVE-2018-20744

The Olivier Poitrey Go CORS handler through 1.3.0 actively converts a wildcard CORS policy into reflecting an arbitrary Origin header value, which is incompatible with the CORS security design, and could lead to CORS misconfiguration security problems.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Go Cors Project ≫ Go Cors Version <= 1.3.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.72% 0.489
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.9 2.2 3.6
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-346 Origin Validation Error

The product does not properly verify that the source of data or communication is valid.

http://www.securityfocus.com/bid/106834
Third Party Advisory
https://github.com/rs/cors/issues/55
Third Party Advisory
Issue Tracking
https://www.usenix.org/system/files/conference/usenixsecurity18/sec18-chen.pdf
Third Party Advisory