Connect Cors
Monthly
Cross-domain authenticated request bypass in the connect-xcors (connect-cors) Node.js middleware lets an attacker defeat origin verification so that a victim's browser issues credentialed cross-origin requests the application would otherwise reject. The flaw is remotely reachable without attacker authentication (CVSS 4.0 PR:N) but requires the victim to be logged in to the affected application and to load attacker-controlled web content (UI:P); impact is bounded to low confidentiality and low integrity with no availability effect, giving low-to-moderate real-world risk. No public exploit code has been identified at time of analysis, and no CISA KEV entry exists for this CVE.
Cross-domain authenticated request bypass in the connect-xcors (connect-cors) Node.js middleware lets an attacker defeat origin verification so that a victim's browser issues credentialed cross-origin requests the application would otherwise reject. The flaw is remotely reachable without attacker authentication (CVSS 4.0 PR:N) but requires the victim to be logged in to the affected application and to load attacker-controlled web content (UI:P); impact is bounded to low confidentiality and low integrity with no availability effect, giving low-to-moderate real-world risk. No public exploit code has been identified at time of analysis, and no CISA KEV entry exists for this CVE.