CVE-2015-9243 Unsafe Merging of CORS Configuration Conflict in hapi
MediumCVSS 5.9
EPSS 1.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
When server level, connection level or route level CORS configurations in hapi node module before 11.1.4 are combined and when a higher level config included security restrictions (like origin), a higher level config that included security restrictions (like origin) would have those restrictions overridden by less restrictive defaults (e.g. origin defaults to all origins *).
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| npm hapi(npm) | < 11.1.4 | 11.1.4 |
| hapijs hapi | < 11.1.4 | 11.1.4 |
| HackerOne hapi node module | = <11.1.4 | No fix listed |
References
- github.com exploit issue-tracking third-party-advisory
- www.npmjs.com
- nvd.nist.gov third-party-advisory
- github.com
- nodesecurity.io third-party-advisory