Exposure of Sensitive Information to an Unauthorized Actor in Concord

ÉLEVÉE 7.5CVE-2020-10591 · GHSA-6566-9526-52v6 · Published 15/03/2020 · updated 17/06/2026

En bref

CVE-2020-10591 est une vulnérabilité ÉLEVÉE (CVSS 7.5) touchant com.walmartlabs.concord:concord-common, concord (walmart).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 2.5%, plus élevée que 84.8% des vulnérabilités.
Correctif : mettre à jour vers 1.44.0 ou plus récent.

Package	Affected versions	Patched versions
com.walmartlabs.concord:concord-common Maven	`< 1.44.0`	`1.44.0`
concord walmart	`< 1.44.0`	`1.44.0`

Description

An issue was discovered in Walmart Labs Concord before 1.44.0. CORS Access-Control-Allow-Origin headers have a potentially unsafe dependency on Origin headers, and are not configurable. This allows remote attackers to discover host information, nodes, API metadata, and references to usernames via api/v1/apikey.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2020-10591 · ADVISORY
walmartlabs/concord · WEB
walmartlabs/concord · PACKAGE
walmartlabs/concord · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free