Vulnerability Report

CVE-2017-20146

Title: Gorillatoolkit Handlers

Other

Proof Of Concept

No public PoC currently indexed for CVE-2017-20146.

CWE Category CWE-346
Published Date Dec 27, 2022
Modified Date Apr 11, 2025
Exploit Status Not Found
Score 9.8 CVSS v3.1
Exploit Probability (EPSS)
0.11%

Vulnerability Summary

CVE-2017-20146: Usage of the CORS handler may apply improper CORS headers, allowing the requester to explicitly control the value of the Access-Control-Allow-Origin header, which bypasses the expected behavior of the Same Origin Policy.

Impacted Vendors

G
gorillatoolkit 1

Reference Links

https://github.com/gorilla/handlers/commit/90663712d74cb411cbef281bc1e08c19d1a76145 https://github.com/gorilla/handlers/pull/116 https://pkg.go.dev/vuln/GO-2020-0020 https://github.com/gorilla/handlers/commit/90663712d74cb411cbef281bc1e08c19d1a76145 https://github.com/gorilla/handlers/pull/116 https://pkg.go.dev/vuln/GO-2020-0020
CVSS v3.1
Source Entity [email protected]
Severity CRITICAL
9.8
Attack Vector
NETWORK
Complexity
LOW
Privileges
N/A
Interaction
NONE
Confidentiality
N/A
Integrity
N/A
Availability
N/A
Scope
UNCHANGED
RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v3.1
Source Entity 134c704f-9b21-4f2e-91b3-4a467353bcc0
Severity CRITICAL
9.8
Attack Vector
NETWORK
Complexity
LOW
Privileges
N/A
Interaction
NONE
Confidentiality
N/A
Integrity
N/A
Availability
N/A
Scope
UNCHANGED
RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2017-20146 Exploits & PoCs (Proof Of Concept)

No public PoCs found in our database for this CVE.

MODIFIED

Vulnerability data or affected products updated.

PUBLISHED

Vulnerability first announced in NVD.

Attack Vector Matrix

Access Vector NETWORK
Complexity LOW
Privileges N/A
Interaction NONE
CVSS Vector String CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Stack

No specific products linked.