CVE-2015-9243

low-risk
Published 2018-05-29

When server level, connection level or route level CORS configurations in hapi node module before 11.1.4 are combined and when a higher level config included security restrictions (like origin), a higher level config that included security restrictions (like origin) would have those restrictions overridden by less restrictive defaults (e.g. origin defaults to all origins `*`).

Do I need to act?

-
0.17% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.9/10 Medium
NETWORK / HIGH complexity

Affected Products (1)

Hapi

Affected Vendors

Hapijs

References (4)

Exploit https://github.com/hapijs/hapi/issues/2980
Third Party Advisory https://nodesecurity.io/advisories/65
Exploit https://github.com/hapijs/hapi/issues/2980
Third Party Advisory https://nodesecurity.io/advisories/65
24
/ 100
low-risk
Severity 18/34 · Moderate
Exploitability 1/34 · Minimal
Exposure 5/34 · Minimal