gorilla/handlers may allow requester to bypass expected behavior of the Same Origin Policy

CRITICO 9.8CVE-2017-20146 · GHSA-jcr6-mmjj-pchw · GO-2020-0020 · Published 27/12/2022 · updated 17/06/2026

In breve

CVE-2017-20146 è una vulnerabilità CRITICO (CVSS 9.8) che riguarda github.com/gorilla/handlers, handlers (gorillatoolkit).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.77%, superiore al 55.6% delle vulnerabilità.
Correzione: aggiornare a 1.3.0 o successiva.

Package	Affected versions	Patched versions
github.com/gorilla/handlers Go	`< 1.3.0`	`1.3.0`
handlers gorillatoolkit	`< 1.3.0`	`1.3.0`

Description

Usage of the CORS handler may apply improper CORS headers, allowing the requester to explicitly control the value of the Access-Control-Allow-Origin header, which bypasses the expected behavior of the Same Origin Policy.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2017-20146 · ADVISORY
gorilla/handlers#116 · WEB
gorilla/handlers commit 9066371 · WEB
gorilla/handlers · PACKAGE
pkg.go.dev/vuln/GO-2020-0020 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free