Go/github.com/gofiber/fiber/v2 CVE-2024-25124: unknown, EPSS 0.66%

Insecure CORS Configuration allowing wildcard origin with credentials in github.com/gofiber/fiber/v2

Action: Upgrade github.com/gofiber/fiber/v2 to 2.52.1 or later.

go get github.com/gofiber/fiber/v2@v2.52.1

Affected

Fixed versions

Sources

• osv: GO-2024-2574
• https://github.com/gofiber/fiber/security/advisories/GHSA-fmg4-x8pw-hjhg
• https://github.com/gofiber/fiber/commit/f0cd3b44b086544a37886232d0530601f2406c23
• http://blog.portswigger.net/2016/10/exploiting-cors-misconfigurations-for.html
• https://codeql.github.com/codeql-query-help/javascript/js-cors-misconfiguration-for-credentials
• https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS/Errors/CORSNotSupportingCredentials
• https://fetch.spec.whatwg.org/#cors-protocol-and-credentials
• https://github.com/gofiber/fiber/releases/tag/v2.52.1
• https://saturncloud.io/blog/cors-cannot-use-wildcard-in-accesscontrolalloworigin-when-credentials-flag-is-true

CVE-2024-25124 · published 2024-05-20T19:46:13Z · modified 2024-05-20T20:13:52.203496Z · JSON