Casdoor CORS misconfiguration (GHSL-2024-035)

Mô tả

Tham khảo

• nvd.nist.gov/vuln/detail/CVE-2024-41657 · ADVISORY
• casdoor/casdoor · PACKAGE
• casdoor/casdoor · WEB
• securitylab.github.com/advisories/GHSL-2024-035_GHSL-2024-036_casdoor · ADVISORY
• securitylab.github.com/advisories/GHSL-2024-035_GHSL-2024-036_casdoor · Exploit
• GitHub Advisory GHSA-mchx-7j67-8mcf · ADVISORY

Lỗ hổng khác của github.com/casdoor/casdoor

• CVE-2026-9098NGHIÊM TRỌNG 9.1In Casdoor versions 2.362.0 and earlier, the SAML callback handler in controllers/auth.go accepts any well-formed SAMLResponse sent to /api/…
• CVE-2026-9097NGHIÊM TRỌNG 9.8Casdoor versions 2.362.0 and earlier do not verify that a JWT used for token exchange is still active. The GetTokenExchangeToken() function …
• CVE-2026-9096CAO 7.5Casdoor versions 2.362.0 and earlier do not enforce SAML assertion time bounds. The gosaml2 library reports all time-validation results, inc…
• CVE-2026-9094NGHIÊM TRỌNG 9.8Casdoor versions 2.362.0 and earlier contain a vulnerability enabling cross-organization token exchange. The GetTokenExchangeToken function …
• CVE-2026-9093NGHIÊM TRỌNG 9.8In Casdoor versions 2.362.0 and earlier, the SAML service provider implementation does not validate the AudienceRestriction element in SAML …