GitHub Advisoryadvisory · Maven

GHSA-6566-9526-52v6 Exposure of Sensitive Information to an Unauthorized Actor in Concord

HIGH Published 2022-02-10 Modified 2025-01-17 Official page ↗
Aliases
CVE-2020-10591
Ecosystem
Maven
Packages
com.walmartlabs.concord:concord-common
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-200
Reviewed
2021-05-03

Affected packages

• Maven com.walmartlabs.concord:concord-common: < 1.44.0 → fixed in 1.44.0

Description

An issue was discovered in Walmart Labs Concord before 1.44.0. CORS Access-Control-Allow-Origin headers have a potentially unsafe dependency on Origin headers, and are not configurable. This allows remote attackers to discover host information, nodes, API metadata, and references to usernames via api/v1/apikey.

Related

Alias · CVE (1)

  • CVE-2020-10591 An issue was discovered in Walmart Labs Concord before 1.44.0. vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References