| modules: |
| - module: github.com/emicklei/go-restful |
| versions: |
| - fixed: 2.16.0+incompatible |
| vulnerable_at: 2.15.0+incompatible |
| packages: |
| - package: github.com/emicklei/go-restful |
| symbols: |
| - CrossOriginResourceSharing.isOriginAllowed |
| derived_symbols: |
| - CrossOriginResourceSharing.Filter |
| - module: github.com/emicklei/go-restful/v2 |
| versions: |
| - introduced: 2.7.1 |
| vulnerable_at: 2.7.1 |
| packages: |
| - package: github.com/emicklei/go-restful/v2 |
| symbols: |
| - CrossOriginResourceSharing.isOriginAllowed |
| derived_symbols: |
| - CrossOriginResourceSharing.Filter |
| - module: github.com/emicklei/go-restful/v3 |
| versions: |
| - introduced: 3.0.0 |
| fixed: 3.8.0 |
| vulnerable_at: 3.7.4 |
| packages: |
| - package: github.com/emicklei/go-restful/v3 |
| symbols: |
| - CrossOriginResourceSharing.isOriginAllowed |
| derived_symbols: |
| - CrossOriginResourceSharing.Filter |
| description: | |
| CORS filters that use an AllowedDomains configuration parameter |
| can match domains outside the specified set, permitting an attacker |
| to avoid the CORS policy. |
| |
| The AllowedDomains configuration parameter is documented as a list of |
| allowed origin domains, but values in this list are applied as regular |
| expression matches. For example, an allowed domain of "example.com" will |
| match the Origin header "example.com.malicious.domain". |
| published: 2022-08-15T18:05:29Z |
| cves: |
| - CVE-2022-1996 |
| ghsas: |
| - GHSA-r48q-9g5r-8q2h |
| references: |
| - fix: https://github.com/emicklei/go-restful/commit/f292efff46ae17e9d104f865a60a39a2ae9402f1 |
| - web: https://github.com/emicklei/go-restful/issues/489 |
