Exposure of Sensitive Information to an Unauthorized Actor in Concord
High severity
GitHub Reviewed
Published
Feb 10, 2022
to the GitHub Advisory Database
•
Updated Feb 1, 2023
Package
Affected versions
< 1.44.0
Patched versions
1.44.0
Description
Published by the National Vulnerability Database
Mar 15, 2020
Reviewed
May 3, 2021
Published to the GitHub Advisory Database
Feb 10, 2022
Last updated
Feb 1, 2023
An issue was discovered in Walmart Labs Concord before 1.44.0. CORS Access-Control-Allow-Origin headers have a potentially unsafe dependency on Origin headers, and are not configurable. This allows remote attackers to discover host information, nodes, API metadata, and references to usernames via api/v1/apikey.
References