{"action":"Upgrade github.com/gofiber/fiber/v2 to 2.52.1 or later.","affected":[{"fixed":"2.52.1","introduced":"0"}],"component":"github.com/gofiber/fiber/v2","cve_ids":["CVE-2024-25124"],"ecosystem":"Go","epss":0.00655,"exploited":false,"fixed_versions":["2.52.1"],"ghsa_id":"GHSA-fmg4-x8pw-hjhg","id":"tcs_01M5KG1H69W8P98ZKPEVJHTM7B","modified_at":"2024-05-20T20:13:52.203496Z","published_at":"2024-05-20T19:46:13Z","references":["https://osv.dev/vulnerability/GO-2024-2574","https://github.com/gofiber/fiber/security/advisories/GHSA-fmg4-x8pw-hjhg","https://github.com/gofiber/fiber/commit/f0cd3b44b086544a37886232d0530601f2406c23","http://blog.portswigger.net/2016/10/exploiting-cors-misconfigurations-for.html","https://codeql.github.com/codeql-query-help/javascript/js-cors-misconfiguration-for-credentials","https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS/Errors/CORSNotSupportingCredentials","https://fetch.spec.whatwg.org/#cors-protocol-and-credentials","https://github.com/gofiber/fiber/releases/tag/v2.52.1","https://saturncloud.io/blog/cors-cannot-use-wildcard-in-accesscontrolalloworigin-when-credentials-flag-is-true"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"GO-2024-2574","url":"https://osv.dev/vulnerability/GO-2024-2574"}],"summary":"Insecure CORS Configuration allowing wildcard origin with credentials in github.com/gofiber/fiber/v2"}