CVE-2017-20146 Improper access control in github.com/gorilla/handlers
CriticalCVSS 9.8
EPSS 0.77%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Usage of the CORS handler may apply improper CORS headers, allowing the requester to explicitly control the value of the Access-Control-Allow-Origin header, which bypasses the expected behavior of the Same Origin Policy.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| gorilla github.com/gorilla/handlers(Go) | < 1.3.0 | 1.3.0 |
| debian/golang-github-gorilla-handlers(Debian:12) | < 1.3.0-1 | 1.3.0-1 |
| debian/golang-github-gorilla-handlers(Debian:13) | < 1.3.0-1 | 1.3.0-1 |
| debian/golang-github-gorilla-handlers(Debian:14) | < 1.3.0-1 | 1.3.0-1 |
| gorillatoolkit handlers | < 1.3.0 | 1.3.0 |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch third-party-advisory
- github.com patch third-party-advisory
- pkg.go.dev third-party-advisory
- github.com
- github.com product
- Debian Security Tracker CVE-2017-20146 vendor-advisory