CVE-2018-20744 github.com/gofiber/fiber/v2 vulnerable to Origin Validation Error
MediumCVSS 5.9
EPSS 0.72%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Olivier Poitrey Go CORS handler through 1.3.0 actively converts a wildcard CORS policy into reflecting an arbitrary Origin header value, which is incompatible with the CORS security design, and could lead to CORS misconfiguration security problems.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| gofiber github.com/gofiber/fiber(Go) | >= 2.0.0, < 2.43.0 | 2.43.0 |
| rs github.com/rs/cors(Go) | < 1.5.0 | 1.5.0 |
| go cors project go cors | <= 1.3.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com
- github.com issue-tracking third-party-advisory
- github.com patch
- github.com patch
- github.com product
- web.archive.org
- www.usenix.org third-party-advisory
- github.com
- 106834 third-party-advisory vdb-entry