What is GHSA-4946-85pr-fvxh?

GHSA-4946-85pr-fvxh is a security advisory published by GitHub Security Advisories with Medium severity. vantage6's CORS settings overly permissive

Which CVE IDs does GHSA-4946-85pr-fvxh cover?

GHSA-4946-85pr-fvxh covers the following CVE IDs: CVE-2024-23823. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-4946-85pr-fvxh?

GHSA-4946-85pr-fvxh has a CVSS v3 base score of 4.2, published by GitHub Security Advisories.

Which products are affected by GHSA-4946-85pr-fvxh?

GHSA-4946-85pr-fvxh affects 1 product, including: pip/vantage6:\u003c= 4.2.2.

GHSA-4946-85pr-fvxhMediumCVSS 4.2

vantage6's CORS settings overly permissive

Vendor

GitHub Security Advisories

Published

March 15, 2024

Last Modified

March 15, 2024

🔗 CVE IDs covered (1)

CVE-2024-23823 →

📋 Description

Impact

The vantage6 server has no restrictions on CORS settings. It should be possible for people to set the allowed origins of the server.

The impact is limited because v6 does not use session cookies

Patches

Workarounds

🎯 Affected products1

pip/vantage6:<= 4.2.2

🔗 References (4)

https://github.com/vantage6/vantage6/security/advisories/GHSA-4946-85pr-fvxh
https://nvd.nist.gov/vuln/detail/CVE-2024-23823
https://github.com/vantage6/vantage6/commit/70bb4e1d889230a841eb364d6c03accd7dd01a41
https://github.com/advisories/GHSA-4946-85pr-fvxh