Go/github.com/gofiber/fiber/v2 CVE-2024-25124: critical 9.4, EPSS 0.66%
Fiber has Insecure CORS Configuration, Allowing Wildcard Origin with Credentials
Action: Upgrade github.com/gofiber/fiber/v2 to 2.52.1 or later.
go get github.com/gofiber/fiber/v2@v2.52.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.52.1 | - |
Fixed versions
| 2.52.1 |
Sources
- osv: GHSA-fmg4-x8pw-hjhg
- https://github.com/gofiber/fiber/security/advisories/GHSA-fmg4-x8pw-hjhg
- https://nvd.nist.gov/vuln/detail/CVE-2024-25124
- https://github.com/gofiber/fiber/commit/f0cd3b44b086544a37886232d0530601f2406c23
- https://codeql.github.com/codeql-query-help/javascript/js-cors-misconfiguration-for-credentials
- https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS/Errors/CORSNotSupportingCredentials
- https://fetch.spec.whatwg.org/#cors-protocol-and-credentials
- https://github.com/gofiber/fiber
- https://github.com/gofiber/fiber/releases/tag/v2.52.1
- https://saturncloud.io/blog/cors-cannot-use-wildcard-in-accesscontrolalloworigin-when-credentials-flag-is-true
- http://blog.portswigger.net/2016/10/exploiting-cors-misconfigurations-for.html
CVE-2024-25124 · published · modified · JSON