CORS Token Disclosure in crumb (GHSA-84fq-6626-w5fg)
Published: 2017-10-24T18:33:36Z
Aliases: CVE-2014-7193
Severity: MODERATE · CWE: CWE-284

When CORS is enabled on a hapi route handler, it is possible to set a crumb token for a different domain. An attacker would need to have an application consumer visit a site they control, request a route supporting CORS, and then retrieve the token. With this token, they could possibly make requests to non CORS routes as this user.

A configuration and scenario where this would occur is unlikely, as most configurations will set CORS globally (where crumb is not used), or not at all.


## Recommendation

Update to version 3.0.0 or greater.

Affected packages:
package: ecosystem: npm
name: crumb
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 3.0.0