CVE-2023-49803
CVSS 3.1 Score 7.5 of 10 (high)
Details
Summary
CVE-2023-49803 affects the popular npm package '@koa/cors' used for implementing Cross-Origin Resource Sharing (CORS) in Node.js-based web applications. Prior to version 5.0.0, the middleware inadvertently returned `Access-Control-Allow-Origin` headers with the requesting origin, even when an allowed origin was not explicitly provided. This behavior effectively disables the Same Origin Policy (SOP), posing a significant security risk. The vulnerability could allow unintended access to protected resources, and while it may be appropriate for prototype environments, it should be clearly documented with associated risks. With the release of version 5.0.0, this issue has been resolved.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions