En bref
- CVE-2024-41657 est une vulnérabilité ÉLEVÉE (CVSS 8.8) touchant github.com/casdoor/casdoor.
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.80%, plus élevée que 56.6% des vulnérabilités.
- Aucune version corrigée n'est encore connue : suivez l'avis de l'éditeur dans les références.
Description
Casdoor is a UI-first Identity and Access Management (IAM) / Single-Sign-On (SSO) platform. In Casdoor 1.577.0 and earlier, a logic vulnerability exists in the beego filter CorsFilter that allows any website to make cross domain requests to Casdoor as the logged in user. Due to the a logic error in checking only for a prefix when authenticating the Origin header, any domain can create a valid subdomain with a valid subdomain prefix (Ex: localhost.example.com), allowing the website to make requests to Casdoor as the current signed-in user.
NVD description
Casdoor is a UI-first Identity and Access Management (IAM) / Single-Sign-On (SSO) platform. In Casdoor 1.577.0 and earlier, a logic vulnerability exists in the beego filter CorsFilter that allows any website to make cross domain requests to Casdoor as the logged in user. Due to the a logic error in checking only for a prefix when authenticating the Origin header, any domain can create a valid subdomain with a valid subdomain prefix (Ex: localhost.example.com), allowing the website to make requests to Casdoor as the current signed-in user.
Autres vulnérabilités de github.com/casdoor/casdoor
Tout voir →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free