CyberRota Analysis
AI-GeneratedThe Grav API plugin for Java is vulnerable due to its default CORS configuration, which allows all origins to access authenticated endpoints, exposing sensitive data and enabling unauthorized write operations if an attacker obtains a valid access token. Organizations using this plugin should prioritize updating to version 1.0.0-rc.16 or later to mitigate the risk of cross-origin attacks. This vulnerability poses a significant threat to any application that relies on the plugin for API functionality, particularly those handling sensitive user data.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
The Grav API plugin (getgrav/grav-plugin-api) before 1.0.0-rc.16 shipped Access-Control-Allow-Origin: * as its default CORS configuration on all responses, including authenticated endpoints and preflight (OPTIONS) responses. Because the plugin accepts credentials via the Authorization and X-API-Token headers (set programmatically by JavaScript rather than via cookies), an attacker who obtains a valid access token (e.g., via log leakage, Referer headers, browser history, or network capture) can issue fully authenticated cross-origin requests from any malicious website to read sensitive data and perform write operations as the token's user. Fixed in 1.0.0-rc.16.