CVE-2022-1996: Authorization Bypass Through User-Controlled Key in emicklei/go-restful
A flaw was found in CORS Filter feature from the go-restful package. When a user inputs a domain which is in AllowedDomains, all domains starting with the same pattern are accepted. This issue could allow an attacker to break the CORS policy by allowing any page to make requests and retrieve data on behalf of users.
Other sources
Authorization Bypass Through User-Controlled Key in GitHub repository emicklei/go-restful prior to v3.8.0.
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2022-1996?
CVE-2022-1996 has been classified with a medium severity level due to its potential impact on CORS policy enforcement.
How do I fix CVE-2022-1996?
To remediate CVE-2022-1996, upgrade the go-restful package to version 3.8.0 or later.
What products are affected by CVE-2022-1996?
CVE-2022-1996 affects the go-restful package and specific versions of openshift-serverless-clients and openshift-gitops-kam.
Can CVE-2022-1996 allow attackers to exploit my application?
Yes, CVE-2022-1996 can allow attackers to bypass CORS policy, enabling malicious actions on behalf of users.
Is there a known workaround for CVE-2022-1996?
There are no reported workarounds for CVE-2022-1996; the recommended action is to apply the latest patch.