CVE-2017-20146

Katalog CVE

CVSS 9.8 · Critical EPSS 0,74%

Kerentanan Origin Validation Error pada gorillatoolkit handlers. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Usage of the CORS handler may apply improper CORS headers, allowing the requester to explicitly control the value of the Access-Control-Allow-Origin header, which bypasses the expected behavior of the Same Origin Policy.

Rincian

Terbit di NVD

27 Desember 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-346: Origin Validation Error

EPSS (30 hari)

0,74% peluang dieksploitasi; lebih tinggi dari 53,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/gorilla/handlers/commit/90663712d74cb411cbef281bc1e08c19d1a76145 patch · advisory pihak ketiga
• https://github.com/gorilla/handlers/pull/116 patch · advisory pihak ketiga
• https://pkg.go.dev/vuln/GO-2020-0020 advisory pihak ketiga