CVE-2020-10591
High
Description
An issue was discovered in Walmart Labs Concord before 1.44.0. CORS Access-Control-Allow-Origin headers have a potentially unsafe dependency on Origin headers, and are not configurable. This allows remote attackers to discover host information, nodes, API metadata, and references to usernames via api/v1/apikey.
SeverityHigh
CVSS7.5
Exploit probability—
ProductWalmart Concord
PublishedMar 15, 2020
First seenMar 15, 2020
How to fix
Update
- walmart concord1.44.0 or later
- com.walmartlabs.concord:concord-common1.44.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| walmart concord | v < 1.44.0 | 1.44.0 |
| com.walmartlabs.concord:concord-commonMaven | v < 1.44.0 | 1.44.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.