CVE-2026-74881

Katalog CVE

CVSS 9.3 · Critical EPSS 0,36%

Kerentanan Permissive Cross-domain Security Policy with Untrusted Domains pada jahlives openssl encrypt. Skor CVSS 3.1 9.3 (Critical) menurut NVD.

Deskripsi (NVD)

openssl_encrypt versions before 1.4.0 configure CORS with allow_origins set to wildcard and allow_credentials enabled to true. Attackers can create malicious websites that make authenticated cross-origin requests to the API on behalf of any user who visits them.

Advisory KUTIM-CSIRT

• Peringatan Keamanan: Rekapitulasi 66 Kerentanan pada Paket Python openssl_encrypt 5 Sep 2026

Rincian

Terbit di NVD

17 Agustus 2026

Terakhir diubah

8 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

9.3 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-942: Permissive Cross-domain Security Policy with Untrusted Domains

EPSS (30 hari)

0,36% peluang dieksploitasi; lebih tinggi dari 28,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-c65f-x25w-62jv mitigasi · advisory vendor
• https://www.vulncheck.com/advisories/openssl-encrypt-before-cors-misconfiguration-via-wildcard-origins advisory pihak ketiga