CoreCVE
Back

MEDIUM

The Crumb plugin before 3.0.0 for Node.js does not properly restrict token access in situations where a hapi route handler has CORS enabled, which allows remote attackers to obtain sensitive information, and potentially obtain the ability to spoof requests to non-CORS routes, via a crafted web site that is visited by an application consumer

Published Dec 25, 2014

Description

The Crumb plugin before 3.0.0 for Node.js does not properly restrict token access in situations where a hapi route handler has CORS enabled, which allows remote attackers to obtain sensitive information, and potentially obtain the ability to spoof requests to non-CORS routes, via a crafted web site that is visited by an application consumer.

Affected products

Remediation

No remediation recorded yet.

Metrics

Weaknesses (1)

CWE-284

References (6)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Dec 25, 2014
Updated Aug 6, 2024
Reserved Sep 26, 2014
Link CVE-2014-7193
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2014-7193
Red Hat
Severity n/a
Public date n/a
Links CVE-2014-7193
GHSA-84FQ-6626-W5FG