GHSA-jcr6-mmjj-pchwCriticalCVSS 9.8

gorilla/handlers may allow requester to bypass expected behavior of the Same Origin Policy

Published
December 28, 2022
Last Modified
February 3, 2023

🔗 CVE IDs covered (1)

CVE-2017-20146 →

📋 Description

Usage of the CORS handler may apply improper CORS headers, allowing the requester to explicitly control the value of the Access-Control-Allow-Origin header, which bypasses the expected behavior of the Same Origin Policy.

🎯 Affected products1

  • go/github.com/gorilla/handlers:< 1.3.0

🔗 References (5)