Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-26236 State: PUBLISHED Published: 2020-11-20T17:55:14 Last Updated: 2024-08-04T15:56:04.107Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: ScratchVerifier Products: ScratchVerifier Problem Types: CWE-287 Description: In ScratchVerifier before commit a603769, an attacker can hijack the verification process to log into someone else's account on any site that uses ScratchVerifier for logins. A possible exploitation would follow these steps: 1. User starts login process. 2. Attacker attempts login for user, and is given the same verification code. 3. User comments code as part of their normal login. 4. Before user can, attacker completes the log
e verification code. 3. User comments code as part of their normal login. 4. Before user can, attacker completes the login process now that the code is commented. 5. User gets a failed login and attacker now has control of the account. Since commit a603769 starting a login twice will generate different verification codes, causing both user and attacker login to fail. For clients that rely on a clone of ScratchVerifier not hosted by the developers, their users may attempt to finish the login process as soon as possible after commenting the code. There is no reliable way for the attacker to know before the user can finish the process that the user has commented the code, so this vulnerability
the attacker to know before the user can finish the process that the user has commented the code, so this vulnerability only really affects those who comment the code and then take several seconds before finishing the login. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ScratchVerifier/ScratchVerifier/security/advisories/GHSA-99cr-hvf7-85g9 - https://github.com/ScratchVerifier/ScratchVerifier/commit/a603769010abf8c1bede91af46e4945314e4aa4a
CVE ID: CVE-2020-26237 State: PUBLISHED Published: 2020-11-24T23:00:21 Last Updated: 2024-08-04T15:56:03.046Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:N) Vendors: highlightjs Products: highlight.js Problem Types: CWE-471 Description: Highlight.js is a syntax highlighter written in JavaScript. Highlight.js versions before 9.18.2 and 10.1.2 are vulnerable to Prototype Pollution. A malicious HTML code block can be crafted that will result in prototype pollution of the base object's prototype during highlighting. If you allow users to insert custom HTML code blocks into your page/app via parsing Markdown code blocks (or similar) and do not filter the language names t
HTML code blocks into your page/app via parsing Markdown code blocks (or similar) and do not filter the language names the user can provide you may be vulnerable. The pollution should just be harmless data but this can cause problems for applications not expecting these properties to exist and can result in strange behavior or application crashes, i.e. a potential DOS vector. If your website or application does not render user provided data it should be unaffected. Versions 9.18.2 and 10.1.2 and newer include fixes for this vulnerability. If you are using version 7 or 8 you are encouraged to upgrade to a newer release. Additional Analyst Notes: - CVE Program Container: References: - https://
are encouraged to upgrade to a newer release. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/highlightjs/highlight.js/security/advisories/GHSA-vfrc-7r7c-w9mx - https://github.com/highlightjs/highlight.js/pull/2636 - https://www.npmjs.com/package/highlight.js - https://github.com/highlightjs/highlight.js/commit/7241013ae011a585983e176ddc0489a7a52f6bb0 - https://lists.debian.org/debian-lts-announce/2020/12/msg00041.html - https://www.oracle.com/security-alerts/cpujul2022.html
CVE ID: CVE-2020-26238 State: PUBLISHED Published: 2020-11-24T23:50:12 Last Updated: 2024-08-04T15:56:04.555Z Severity: HIGH (CVSS 7.9 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: jmrozanec Products: cron-utils Problem Types: CWE-74 Description: Cron-utils is a Java library to parse, validate, migrate crons as well as get human readable descriptions for them. In cron-utils before version 9.1.3, a template Injection vulnerability is present. This enables attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution (RCE) vulnerability. Only projects using the @Cron annotation to validate untrusted Cron expressions are affected. This issue was pa
ability. Only projects using the @Cron annotation to validate untrusted Cron expressions are affected. This issue was patched in version 9.1.3. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jmrozanec/cron-utils/security/advisories/GHSA-pfj3-56hm-jwq5 - https://github.com/jmrozanec/cron-utils/issues/461 - https://github.com/jmrozanec/cron-utils/commit/4cf373f7352f5d95f0bf6512af8af326b31c835e - https://lists.apache.org/thread.html/r96937fc9c82f3201b59311c067e97bce71123944f93102169a95bf5c%40%3Cissues.hive.apache.org%3E - https://lists.apache.org/thread.html/r5f601d15292e3302ad0ae0e89527029546945b1cd5837af7e838d354%40%3Cdev.hive.apache.org%3E - https://lists
he.org/thread.html/r5f601d15292e3302ad0ae0e89527029546945b1cd5837af7e838d354%40%3Cdev.hive.apache.org%3E - https://lists.apache.org/thread.html/ra9e81244d323898dde3c979dd7df6996e4037d14a01b6629ea443548%40%3Cissues.hive.apache.org%3E - https://lists.apache.org/thread.html/r855aead591697dc2e85faf66c99036e49f492431940b78d4e6d895b5%40%3Cgitbox.hive.apache.org%3E - https://lists.apache.org/thread.html/r9ae9a9fb1c8e2bf95c676e7e4cd06aa04f0a3a8a9ec1a6b787afb00f%40%3Cissues.hive.apache.org%3E - https://lists.apache.org/thread.html/r71083c759dc627f198571b3d48b6745fe798b1d53c34f7ef8de9e7dd%40%3Cissues.hive.apache.org%3E - https://lists.apache.org/thread.html/r50e1b5544c37e408ed7e9a958b28237b1cb9660ba2b
9e7dd%40%3Cissues.hive.apache.org%3E - https://lists.apache.org/thread.html/r50e1b5544c37e408ed7e9a958b28237b1cb9660ba2b3dba46f343e23%40%3Cissues.hive.apache.org%3E - https://lists.apache.org/thread.html/r432a69a1a85cbcb1f1bad2aa0fbfce0367bf894bf917f6ed7118e7f0%40%3Cissues.hive.apache.org%3E - https://lists.apache.org/thread.html/r737406bc17d49ffe8fe6a8828d390ee0a02e45e5a5b4f931180b9a93%40%3Cissues.hive.apache.org%3E - https://lists.apache.org/thread.html/r390bb7630b7ea8f02bf7adbbe69c0ae8b562c527d663c543d965f959%40%3Cgitbox.hive.apache.org%3E
CVE ID: CVE-2020-26239 State: PUBLISHED Published: 2020-11-23T19:05:15 Last Updated: 2024-08-04T15:56:04.027Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:N) Vendors: ScratchAddons Products: ScratchAddons Problem Types: CWE-79 Description: Scratch Addons is a WebExtension that supports both Chrome and Firefox. Scratch Addons before version 1.3.2 is vulnerable to DOM-based XSS. If the victim visited a specific website, the More Links addon of the Scratch Addons extension used incorrect regular expression which caused the HTML-escaped values to be unescaped, leading to XSS. Scratch Addons version 1.3.2 fixes the bug. The extension will be automatically updated by the bro
aped, leading to XSS. Scratch Addons version 1.3.2 fixes the bug. The extension will be automatically updated by the browser. More Links addon can be disabled via the option of the extension. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ScratchAddons/ScratchAddons/security/advisories/GHSA-6qfq-px3r-xj4p - https://github.com/ScratchAddons/ScratchAddons/commit/b9a52d6532c8514254c7cc1d8e18710dbedc41ff - https://github.com/ScratchAddons/ScratchAddons/blob/a471893df403f86c9182970678175d4772a0690c/addons/more-links/userscript.js#L15 - https://github.com/ScratchAddons/ScratchAddons/releases/tag/v1.3.2
CVE ID: CVE-2020-26240 State: PUBLISHED Published: 2020-11-25T01:25:27 Last Updated: 2024-08-04T15:56:04.861Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: ethereum Products: go-ethereum Problem Types: CWE-682 Description: Go Ethereum, or "Geth", is the official Golang implementation of the Ethereum protocol. An ethash mining DAG generation flaw in Geth before version 1.9.24 could cause miners to erroneously calculate PoW in an upcoming epoch (estimated early January, 2021). This happened on the ETC chain on 2020-11-06. This issue is relevant only for miners, non-mining nodes are unaffected. This issue is fixed as of 1.9.24 Additional Analyst Notes: - CVE
vant only for miners, non-mining nodes are unaffected. This issue is fixed as of 1.9.24 Additional Analyst Notes: - CVE Program Container: References: - https://blog.ethereum.org/2020/11/12/geth_security_release/ - https://github.com/ethereum/go-ethereum/security/advisories/GHSA-v592-xf75-856p - https://github.com/ethereum/go-ethereum/pull/21793 - https://github.com/ethereum/go-ethereum/commit/d990df909d7839640143344e79356754384dcdd0
CVE ID: CVE-2020-26241 State: PUBLISHED Published: 2020-11-25T01:25:20 Last Updated: 2024-08-04T15:56:03.871Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: ethereum Products: go-ethereum Problem Types: CWE-682 Description: Go Ethereum, or "Geth", is the official Golang implementation of the Ethereum protocol. This is a Consensus vulnerability in Geth before version 1.9.17 which can be used to cause a chain-split where vulnerable nodes reject the canonical chain. Geth's pre-compiled dataCopy (at 0x00...04) contract did a shallow copy on invocation. An attacker could deploy a contract that writes X to an EVM memory region R, then calls 0x00..04 with R as an
vocation. An attacker could deploy a contract that writes X to an EVM memory region R, then calls 0x00..04 with R as an argument, then overwrites R to Y, and finally invokes the RETURNDATACOPY opcode. When this contract is invoked, a consensus-compliant node would push X on the EVM stack, whereas Geth would push Y. This is fixed in version 1.9.17. Additional Analyst Notes: - CVE Program Container: References: - https://blog.ethereum.org/2020/11/12/geth_security_release/ - https://github.com/ethereum/go-ethereum/security/advisories/GHSA-69v6-xc2j-r2jf
CVE ID: CVE-2020-26242 State: PUBLISHED Published: 2020-11-25T01:25:15 Last Updated: 2024-08-04T15:56:03.570Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: ethereum Products: go-ethereum Problem Types: Denial-of-service Description: Go Ethereum, or "Geth", is the official Golang implementation of the Ethereum protocol. In Geth before version 1.9.18, there is a Denial-of-service (crash) during block processing. This is fixed in 1.9.18. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ethereum/go-ethereum/security/advisories/GHSA-jm5c-rv3w-w83m - https://blog.ethereum.org/2020/11/12/geth_security_release/
CVE ID: CVE-2020-26243 State: PUBLISHED Published: 2020-11-25T16:50:15 Last Updated: 2024-08-04T15:56:04.801Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: nanopb Products: nanopb Problem Types: CWE-20, CWE-119 Description: Nanopb is a small code-size Protocol Buffers implementation. In Nanopb before versions 0.4.4 and 0.3.9.7, decoding specifically formed message can leak memory if dynamic allocation is enabled and an oneof field contains a static submessage that contains a dynamic field, and the message being decoded contains the submessage multiple times. This is rare in normal messages, but it is a concern when untrusted data is parsed. This is fixed in
ge multiple times. This is rare in normal messages, but it is a concern when untrusted data is parsed. This is fixed in versions 0.3.9.7 and 0.4.4. The following workarounds are available: 1) Set the option `no_unions` for the oneof field. This will generate fields as separate instead of C union, and avoids triggering the problematic code. 2) Set the type of the submessage field inside oneof to `FT_POINTER`. This way the whole submessage will be dynamically allocated and the problematic code is not executed. 3) Use an arena allocator for nanopb, to make sure all memory can be released afterwards. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nanopb/nanop
be released afterwards. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nanopb/nanopb/security/advisories/GHSA-85rr-4rh9-hhwh - https://github.com/nanopb/nanopb/issues/615 - https://github.com/nanopb/nanopb/commit/4fe23595732b6f1254cfc11a9b8d6da900b55b0c - https://github.com/nanopb/nanopb/blob/2b48a361786dfb1f63d229840217a93aae064667/CHANGELOG.txt
CVE ID: CVE-2020-26244 State: PUBLISHED Published: 2020-12-02T20:05:15 Last Updated: 2024-08-04T15:56:04.228Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: OpenIDC Products: pyoidc Problem Types: CWE-325, CWE-347 Description: Python oic is a Python OpenID Connect implementation. In Python oic before version 1.2.1, there are several related cryptographic issues affecting client implementations that use the library. The issues are: 1) The IdToken signature algorithm was not checked automatically, but only if the expected algorithm was passed in as a kwarg. 2) JWA `none` algorithm was allowed in all flows. 3) oic.consumer.Consumer.parse_authz returns an unver
d in as a kwarg. 2) JWA `none` algorithm was allowed in all flows. 3) oic.consumer.Consumer.parse_authz returns an unverified IdToken. The verification of the token was left to the discretion of the implementator. 4) iat claim was not checked for sanity (i.e. it could be in the future). These issues are patched in version 1.2.1. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OpenIDC/pyoidc/security/advisories/GHSA-4fjv-pmhg-3rfg - https://pypi.org/project/oic/ - https://github.com/OpenIDC/pyoidc/commit/62f8d753fa17c8b1f29f8be639cf0b33afb02498 - https://github.com/OpenIDC/pyoidc/releases/tag/1.2.1
CVE ID: CVE-2020-26245 State: PUBLISHED Published: 2020-11-27T19:50:04 Last Updated: 2024-08-04T15:56:03.692Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:L) Vendors: sebhildebrandt Products: systeminformation Problem Types: CWE-78, CWE-471 Description: npm package systeminformation before version 4.30.5 is vulnerable to Prototype Pollution leading to Command Injection. The issue was fixed with a rewrite of shell sanitations to avoid prototyper pollution problems. The issue is fixed in version 4.30.5. If you cannot upgrade, be sure to check or sanitize service parameter strings that are passed to si.inetChecksite(). Additional Analyst Notes: - CVE Program Container: Re
e service parameter strings that are passed to si.inetChecksite(). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-4v2w-h9jm-mqjg - https://github.com/sebhildebrandt/systeminformation/commit/8113ff0e87b2f422a5756c48f1057575e73af016
CVE ID: CVE-2020-26246 State: PUBLISHED Published: 2020-12-03T00:55:15 Last Updated: 2024-08-04T15:56:04.466Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N) Vendors: pimcore Products: pimcore Problem Types: CWE-285 Description: Pimcore is an open source digital experience platform. In Pimcore before version 6.8.5 it is possible to modify & create website settings without having the appropriate permissions. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pimcore/pimcore/security/advisories/GHSA-7p8p-4253-3mg6 - https://github.com/pimcore/pimcore/pull/7618
CVE ID: CVE-2020-26247 State: PUBLISHED Published: 2020-12-30T00:00:00 Last Updated: 2024-08-04T15:56:04.939Z Severity: LOW (CVSS 2.6 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: sparklemotion Products: nokogiri Problem Types: CWE-611 Description: Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. In Nokogiri before version 1.11.0.rc4 there is an XXE vulnerability. XML Schemas parsed by Nokogiri::XML::Schema are trusted by default, allowing external resources to be accessed over the network, potentially enabling XXE or SSRF attacks. This behavior is counter to the security policy followed by Nokogiri maintainers, which is to trea
XXE or SSRF attacks. This behavior is counter to the security policy followed by Nokogiri maintainers, which is to treat all input as untrusted by default whenever possible. This is fixed in Nokogiri version 1.11.0.rc4. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-vr8q-g5c7-m54m - https://rubygems.org/gems/nokogiri - https://hackerone.com/reports/747489 - https://github.com/sparklemotion/nokogiri/releases/tag/v1.11.0.rc4 - https://github.com/sparklemotion/nokogiri/commit/9c87439d9afa14a365ff13e73adc809cb2c3d97b - https://lists.debian.org/debian-lts-announce/2021/06/msg00007.html - https://security.gentoo.
65ff13e73adc809cb2c3d97b - https://lists.debian.org/debian-lts-announce/2021/06/msg00007.html - https://security.gentoo.org/glsa/202208-29 - https://lists.debian.org/debian-lts-announce/2022/10/msg00018.html
CVE ID: CVE-2020-26248 State: PUBLISHED Published: 2020-12-03T20:55:13 Last Updated: 2024-08-04T15:56:04.591Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H) Vendors: PrestaShop Products: productcomments Problem Types: CWE-89 Description: In the PrestaShop module "productcomments" before version 4.2.1, an attacker can use a Blind SQL injection to retrieve data or stop the MySQL service. The problem is fixed in 4.2.1 of the module. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PrestaShop/productcomments/security/advisories/GHSA-5v44-7647-xfw9 - https://packagist.org/packages/prestashop/productcomments - https://github.com/PrestaSh
advisories/GHSA-5v44-7647-xfw9 - https://packagist.org/packages/prestashop/productcomments - https://github.com/PrestaShop/productcomments/commit/7c2033dd811744e021da8897c80d6c301cd45ffa - https://github.com/PrestaShop/productcomments/releases/tag/v4.2.1 - http://packetstormsecurity.com/files/160539/PrestaShop-ProductComments-4.2.0-SQL-Injection.html
CVE ID: CVE-2020-26249 State: PUBLISHED Published: 2020-12-08T23:55:14 Last Updated: 2024-08-04T15:56:03.590Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: Cog-Creators Products: Red-Dashboard Problem Types: CWE-79 Description: Red Discord Bot Dashboard is an easy-to-use interactive web dashboard to control your Redbot. In Red Discord Bot before version 0.1.7a an RCE exploit has been discovered. This exploit allows Discord users with specially crafted Server names and Usernames/Nicknames to inject code into the webserver front-end code. By abusing this exploit, it's possible to perform destructive actions and/or access sensitive information. This high severi
abusing this exploit, it's possible to perform destructive actions and/or access sensitive information. This high severity exploit has been fixed on version 0.1.7a. There are no workarounds, bot owners must upgrade their relevant packages (Dashboard module and Dashboard webserver) in order to patch this issue. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Cog-Creators/Red-Dashboard/security/advisories/GHSA-hm45-mgqm-gjm4 - https://pypi.org/project/Red-Dashboard - https://github.com/Cog-Creators/Red-Dashboard/commit/a6b9785338003ec87fb75305e7d1cc2d40c7ab91 - https://github.com/Cog-Creators/Red-Dashboard/commit/99d88b840674674166ce005b784ae8e31e955ab1
CVE ID: CVE-2020-26250 State: PUBLISHED Published: 2020-12-01T20:30:16 Last Updated: 2024-08-04T15:56:04.431Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: jupyterhub Products: oauthenticator Problem Types: CWE-863 Description: OAuthenticator is an OAuth login mechanism for JupyterHub. In oauthenticator from version 0.12.0 and before 0.12.2, the deprecated (in jupyterhub 1.2) configuration `Authenticator.whitelist`, which should be transparently mapped to `Authenticator.allowed_users` with a warning, is instead ignored by OAuthenticator classes, resulting in the same behavior as if this configuration has not been set. If this is the only mechanism of autho
lasses, resulting in the same behavior as if this configuration has not been set. If this is the only mechanism of authorization restriction (i.e. no group or team restrictions in configuration) then all authenticated users will be allowed. Provider-based restrictions, including deprecated values such as `GitHubOAuthenticator.org_whitelist` are **not** affected. All users of OAuthenticator 0.12.0 and 0.12.1 with JupyterHub 1.2 (JupyterHub Helm chart 0.10.0-0.10.5) who use the `admin.whitelist.users` configuration in the jupyterhub helm chart or the `c.Authenticator.whitelist` configuration directly. Users of other deprecated configuration, e.g. `c.GitHubOAuthenticator.team_whitelist` are **n
t` configuration directly. Users of other deprecated configuration, e.g. `c.GitHubOAuthenticator.team_whitelist` are **not** affected. If you see a log line like this and expect a specific list of allowed usernames: "[I 2020-11-27 16:51:54.528 JupyterHub app:1717] Not using allowed_users. Any authenticated user will be allowed." you are likely affected. Updating oauthenticator to 0.12.2 is recommended. A workaround is to replace the deprecated `c.Authenticator.whitelist = ...` with `c.Authenticator.allowed_users = ...`. If any users have been authorized during this time who should not have been, they must be deleted via the API or admin interface, per the referenced documentation. Additional
should not have been, they must be deleted via the API or admin interface, per the referenced documentation. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jupyterhub/oauthenticator/security/advisories/GHSA-384w-5v3f-q499 - https://github.com/jupyterhub/oauthenticator/commit/a4aac191c16cf6281f3d346615aefa75702b02d7 - https://github.com/jupyterhub/oauthenticator/blob/master/docs/source/changelog.md#0122---2020-11-30 - https://jupyterhub.readthedocs.io/en/1.2.2/getting-started/authenticators-users-basics.html#add-or-remove-users-from-the-hub
CVE ID: CVE-2020-26251 State: PUBLISHED Published: 2020-12-18T17:20:13 Last Updated: 2024-08-04T15:56:03.634Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: open-zaak Products: open-zaak Problem Types: CWE-346 Description: Open Zaak is a modern, open-source data- and services-layer to enable zaakgericht werken, a Dutch approach to case management. In Open Zaak before version 1.3.3 the Cross-Origin-Resource-Sharing policy in Open Zaak is currently wide open - every client is allowed. This allows evil.com to run scripts that perform AJAX calls to known Open Zaak installations, and the browser will not block these. This was intended to only apply to developmen
ls to known Open Zaak installations, and the browser will not block these. This was intended to only apply to development machines running on localhost/127.0.0.1. Open Zaak 1.3.3 disables CORS by default, while it can be opted-in through environment variables. The vulnerability does not actually seem exploitable because: a) The session cookie has a `Same-Site: Lax` policy which prevents it from being sent along in Cross-Origin requests. b) All pages that give access to (production) data are login-protected c) `Access-Control-Allow-Credentials` is set to `false` d) CSRF checks probably block the remote origin, since they're not explicitly added to the trusted allowlist. Additional Analyst Not
ks probably block the remote origin, since they're not explicitly added to the trusted allowlist. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/open-zaak/open-zaak/security/advisories/GHSA-chhr-gxrg-64x7 - https://github.com/open-zaak/open-zaak/commit/952269269f1b629fce9c94485f83ac13f31d6c46 - https://github.com/open-zaak/open-zaak/blob/master/CHANGELOG.rst#133-2020-12-17