CVE-2025-63388

Katalog CVE

CVSS 9.1 · Critical EPSS 0,22%

Kerentanan Origin Validation Error pada langgenius dify. Skor CVSS 3.1 9.1 (Critical) menurut NVD.

Deskripsi (NVD)

A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/system-features endpoint. The endpoint implements an overly permissive CORS policy that reflects arbitrary Origin headers and sets Access-Control-Allow-Credentials: true, allowing any external domain to make authenticated cross-origin requests. NOTE: the Supplier disputes this, providing the rationale of "sending requests with credentials does not provide any additional access compared to unauthenticated requests."

Rincian

Terbit di NVD

18 Desember 2025

Terakhir diubah

13 Oktober 2026

Status NVD

Modified

CVSS 3.1

9.1 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-346: Origin Validation Error

EPSS (30 hari)

0,22% peluang dieksploitasi; lebih tinggi dari 11,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://gist.github.com/Cristliu/5ded6d03e41d7d66ecb1b568bae3ff6c advisory pihak ketiga
• https://gist.github.com/Cristliu/c2bc7d05abd89db8eb542a453a528d77
• https://github.com/langgenius/dify/discussions issue tracking