gofiber/fiber · Security
github.com/gofiber/fiber/v2 vulnerable to Origin Validation Error
- GHSA ID
- GHSA-927h-x4qj-r242
- CVE ID
- CVE-2018-20744
- Severity
- medium
- Published
- Updated
- CVSS
- 5.9 · CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
- CVSS v3
- 5.9 · CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Description
The Olivier Poitrey Go CORS handler through 1.3.0 actively converts a wildcard CORS policy into reflecting an arbitrary Origin header value, which is incompatible with the CORS security design, and could lead to CORS misconfiguration security problems.
CWEs
- CWE-346 · Origin Validation Error
References
- https://nvd.nist.gov/vuln/detail/CVE-2018-20744 ↗
- https://github.com/rs/cors/issues/55 ↗
- https://www.usenix.org/system/files/conference/usenixsecurity18/sec18-chen.pdf ↗
- https://github.com/gofiber/fiber/issues/2338 ↗
- https://github.com/gofiber/fiber/pull/2339 ↗
- https://web.archive.org/web/20200227091122/http://www.securityfocus.com/bid/106834 ↗
- https://github.com/rs/cors/pull/57 ↗
- https://github.com/advisories/GHSA-927h-x4qj-r242 ↗