Usage of the CORS handler may apply improper CORS headers, allowing the requester to explicitly control the value of the Access-Control-Allow-Origin header, which bypasses the expected behavior of the Same Origin Policy.
The product does not properly verify that the source of data or communication is valid.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Handlers | Gorillatoolkit | * | 1.3.0 (excluding) |
| Golang-github-coreos-discovery-etcd-io | Ubuntu | kinetic | * |
| Golang-github-coreos-discovery-etcd-io | Ubuntu | lunar | * |
| Golang-github-coreos-discovery-etcd-io | Ubuntu | mantic | * |
| Golang-github-coreos-discovery-etcd-io | Ubuntu | trusty | * |
| Golang-github-coreos-discovery-etcd-io | Ubuntu | xenial | * |
| Golang-github-gorilla-handlers | Ubuntu | bionic | * |
| Golang-github-gorilla-handlers | Ubuntu | kinetic | * |
| Golang-github-gorilla-handlers | Ubuntu | lunar | * |
| Golang-github-gorilla-handlers | Ubuntu | mantic | * |
| Golang-github-gorilla-handlers | Ubuntu | trusty | * |
| Golang-github-gorilla-handlers | Ubuntu | xenial | * |