Cors Misconfiguration CVE-2022-26969

CRITICAL

Permissive Cross-domain Security Policy with Untrusted Domains (CWE-942)

2022-12-26 cve@mitre.org

Information Disclosure Cors Misconfiguration Directus

9.8

CVSS 3.1 · NVD

Share

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

1

CVE Published

Dec 26, 2022 - 06:15 nvd

CRITICAL 9.8

DescriptionNVD

In Directus before 9.7.0, the default settings of CORS_ORIGIN and CORS_ENABLED are true.

AnalysisAI

In Directus before 9.7.0, the default settings of CORS_ORIGIN and CORS_ENABLED are true. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Technical ContextAI

This vulnerability is classified under CWE-942. In Directus before 9.7.0, the default settings of CORS_ORIGIN and CORS_ENABLED are true. Affected products include: Monospace Directus. Version information: before 9.7.0.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Cors Misconfiguration

View all

CVE-2024-41657 HIGH This Week POC

Casdoor is a UI-first Identity and Access Management (IAM) / Single-Sign-On (SSO) platform. Rated high severity (CVSS 8.

CVE-2021-34435 HIGH This Week POC

In Eclipse Theia 0.3.9 to 1.8.1, the "mini-browser" extension allows a user to preview HTML files in an iframe inside th

CVE-2025-30354 HIGH This Week POC

Bruno is an open source IDE for exploring and testing APIs. Rated high severity (CVSS 8.7), this vulnerability is no aut

CVE-2024-41659 HIGH This Week POC

memos is a privacy-first, lightweight note-taking service. Rated high severity (CVSS 8.1), this vulnerability is remotel

CVE-2026-70604 HIGH This Week POC

Cross-origin read bypass in Electron's custom protocol handler exposes sensitive application data to remote pages via fe

CVE-2026-15966 CRITICAL Act Now

Information disclosure in Progress MOVEit Transfer (all versions before 2025.1.5, and 2026.0.0 before 2026.0.3) stems fr

CVE-2025-61163 CRITICAL Act Now

Sensitive-data exposure in Cohere North AI v1.1.5 stems from the server accepting cross-origin requests without validati

CVE-2024-37131 CRITICAL Act Now

SCG Policy Manager, all versions, contains an overly permissive Cross-Origin Resource Policy (CORP) vulnerability. Rated

CVE-2022-31736 CRITICAL Act Now

A malicious website could have learned the size of a cross-origin resource that supported Range requests. Rated critical

CVE-2026-34449 CRITICAL Act Now

Remote code execution in SiYuan desktop application (versions prior to 3.6.2) allows unauthenticated remote attackers to

CVE-2026-6662 MEDIUM This Month POC

Permissive CORS policy in ericc-ch copilot-api up to version 0.7.0 allows remote attackers to access the Token Endpoint

CVE-2026-9739 CRITICAL Act Now

Cross-origin data exposure in Google's MCP Toolbox for Databases stems from the SSE initialization handler unconditional

Same weakness CWE-942 – Permissive Cross-domain Security Policy with Untrusted Domains

View all

CVE-2024-41657 HIGH POC

CVE-2021-34435 HIGH POC

CVE-2025-30354 HIGH POC

CVE-2024-41659 HIGH POC

CVE-2026-25478 HIGH POC

CVE-2026-70604 HIGH POC

CVE-2026-15966 CRITICAL

CVE-2025-61163 CRITICAL

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

CVE-2021-34523 CRITICAL POC

CVE-2013-2251 CRITICAL POC

CVE-2017-5638 CRITICAL POC

CVE-2025-24813 CRITICAL POC

CVE-2015-1701 HIGH POC

CVE-2017-0147 HIGH POC

CVE-2014-6324 HIGH POC

Share

CVE-2022-26969 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy