CyberRota Analysis
AI-GeneratedOpenSSL versions prior to 1.4.0 are vulnerable due to improper CORS configuration, allowing the `allow_origins` setting to be a wildcard while enabling `allow_credentials`. This flaw permits attackers to craft malicious websites that can make authenticated cross-origin requests to the API, potentially compromising user data. Organizations utilizing affected OpenSSL versions should prioritize updating to mitigate the risk of unauthorized access to sensitive information.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
openssl_encrypt versions before 1.4.0 configure CORS with allow_origins set to wildcard and allow_credentials enabled to true. Attackers can create malicious websites that make authenticated cross-origin requests to the API on behalf of any user who visits them.
Related CVEs
Other vulnerabilities affecting the same vendor(s)