Fluid Attacks Database

Description

github.com/gofiber/fiber/v2 vulnerable to Origin Validation Error The Olivier Poitrey Go CORS handler through 1.3.0 actively converts a wildcard CORS policy into reflecting an arbitrary Origin header value, which is incompatible with the CORS security design, and could lead to CORS misconfiguration security problems.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
go	github.com/gofiber/fiber/v2	>=2.0.0 <2.43.0	2.43.0
go	github.com/rs/cors	>=0 <1.5.0	1.5.0

Aliases

1. CVE-2018-207442. NVD-2018-207443. OSV-2018-207444. GCVE-2018-20744

References

1. https://github.com/gofiber/fiber/issues/23382. https://github.com/rs/cors/issues/553. https://github.com/gofiber/fiber/pull/23394. https://github.com/rs/cors/pull/575. https://web.archive.org/web/20200227091122/http://www.securityfocus.com/bid/1068346. https://www.usenix.org/system/files/conference/usenixsecurity18/sec18-chen.pdf

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.