6.4

CVE-2021-39185

Default CORS config allows any origin with credentials

Http4s is a minimal, idiomatic Scala interface for HTTP services. In http4s versions 0.21.26 and prior, 0.22.0 through 0.22.2, 0.23.0, 0.23.1, and 1.0.0-M1 through 1.0.0-M24, the default CORS configuration is vulnerable to an origin reflection attack. The middleware is also susceptible to a Null Origin Attack. The problem is fixed in 0.21.27, 0.22.3, 0.23.2, and 1.0.0-M25. The original `CORS` implementation and `CORSConfig` are deprecated. See the GitHub GHSA for more information, including code examples and workarounds.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Typelevel ≫ Http4s Version <= 0.21.26
Typelevel ≫ Http4s Version >= 0.22.0 <= 0.22.2
Typelevel ≫ Http4s Version 0.23.0
Typelevel ≫ Http4s Version 0.23.1
Typelevel ≫ Http4s Version 1.0.0 Update milestone1
Typelevel ≫ Http4s Version 1.0.0 Update milestone10
Typelevel ≫ Http4s Version 1.0.0 Update milestone11
Typelevel ≫ Http4s Version 1.0.0 Update milestone12
Typelevel ≫ Http4s Version 1.0.0 Update milestone13
Typelevel ≫ Http4s Version 1.0.0 Update milestone14
Typelevel ≫ Http4s Version 1.0.0 Update milestone15
Typelevel ≫ Http4s Version 1.0.0 Update milestone16
Typelevel ≫ Http4s Version 1.0.0 Update milestone17
Typelevel ≫ Http4s Version 1.0.0 Update milestone18
Typelevel ≫ Http4s Version 1.0.0 Update milestone19
Typelevel ≫ Http4s Version 1.0.0 Update milestone2
Typelevel ≫ Http4s Version 1.0.0 Update milestone20
Typelevel ≫ Http4s Version 1.0.0 Update milestone21
Typelevel ≫ Http4s Version 1.0.0 Update milestone22
Typelevel ≫ Http4s Version 1.0.0 Update milestone23
Typelevel ≫ Http4s Version 1.0.0 Update milestone24
Typelevel ≫ Http4s Version 1.0.0 Update milestone3
Typelevel ≫ Http4s Version 1.0.0 Update milestone4
Typelevel ≫ Http4s Version 1.0.0 Update milestone5
Typelevel ≫ Http4s Version 1.0.0 Update milestone6
Typelevel ≫ Http4s Version 1.0.0 Update milestone7
Typelevel ≫ Http4s Version 1.0.0 Update milestone8
Typelevel ≫ Http4s Version 1.0.0 Update milestone9
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.59% 0.439
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.4 10 4.9
AV:N/AC:L/Au:N/C:P/I:P/A:N
security-advisories@github.com 9.1 3.9 5.2
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE-346 Origin Validation Error

The product does not properly verify that the source of data or communication is valid.

https://github.com/http4s/http4s/releases/tag/v0.23.2
Third Party Advisory
https://github.com/http4s/http4s/security/advisories/GHSA-52cf-226f-rhr6
Patch
Third Party Advisory