GitHub Advisoryadvisory · npm

GHSA-g27j-74fp-xfpr Insecure default value for CORS configuration

CRITICAL Published 2022-04-05 Modified 2025-04-14 Official page ↗
Aliases
CVE-2022-26969
Ecosystem
npm
Packages
directus
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-942
Reviewed
2022-04-05

Affected packages

• npm directus: < 9.7.0 → fixed in 9.7.0

Description

Impact The default value for the `CORS_ENABLED` and `CORS_ORIGIN` configuration was set to be very permissive by default. This could lead to unauthorized access in uncontrolled environments when the configuration hasn't been changed. Patches The default values for CORS have been changed in https://github.com/directus/directus/pull/12022 which is released under 9.7.0 Workarounds Configure the CORS environment variables to match your project's usage, rather than leaving them at the (permissive) defaults. For more information If you have any questions or comments about this advisory: • Open an issue in directus/directus • Email us at [email protected]

Related

Alias · CVE (1)

  • CVE-2022-26969 In Directus before 9.7.0, the default settings of CORS_ORIGIN and CORS_ENABLED are true. vulnerability

Weakness · CWE (1)

  • CWE-942 Permissive Cross-domain Security Policy with Untrusted Domains weakness

References