Moderate severityOSV Advisory· Published Jan 28, 2019· Updated Aug 5, 2024
CVE-2018-20744
CVE-2018-20744
Description
The Olivier Poitrey Go CORS handler through 1.3.0 actively converts a wildcard CORS policy into reflecting an arbitrary Origin header value, which is incompatible with the CORS security design, and could lead to CORS misconfiguration security problems.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/gofiber/fiber/v2Go | >= 2.0.0, < 2.43.0 | 2.43.0 |
github.com/rs/corsGo | < 1.5.0 | 1.5.0 |
Affected products
3- ghsa-coords2 versions
>= 2.0.0, < 2.43.0+ 1 more
- (no CPE)range: >= 2.0.0, < 2.43.0
- (no CPE)range: < 1.5.0
Patches
Vulnerability mechanics
References
9- github.com/advisories/GHSA-927h-x4qj-r242ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2018-20744ghsaADVISORY
- www.securityfocus.com/bid/106834mitrevdb-entryx_refsource_BID
- github.com/gofiber/fiber/issues/2338ghsaWEB
- github.com/gofiber/fiber/pull/2339ghsaWEB
- github.com/rs/cors/issues/55ghsax_refsource_MISCWEB
- github.com/rs/cors/pull/57ghsaWEB
- web.archive.org/web/20200227091122/http://www.securityfocus.com/bid/106834ghsaWEB
- www.usenix.org/system/files/conference/usenixsecurity18/sec18-chen.pdfghsax_refsource_MISCWEB
News mentions
0No linked articles in our index yet.