CVE-2026-121821
2026-11-06
08h17 +00:00
08h17 +00:00
指定 CVE 通知
掌握特定 CVE 的任何變更。
CVE 描述
A vulnerability has been identified in armeria versions 0.84.0 through 1.42.0, where any-origin CORS policies do not enforce configured path restrictions, allowing an attacker-controlled website visited by an authenticated victim to read sensitive responses from excluded paths when credentials are enabled and the victim's browser sends authentication credentials.
CVE 資訊
相關弱點
| 弱點名稱 | 來源 | |
|---|---|---|
| Permissive Cross-domain Security Policy with Untrusted Domains The product uses a web-client protection mechanism such as a Content Security Policy (CSP) or cross-domain policy file, but the policy includes untrusted domains with which the web client is allowed to communicate. |
