CVE-2021-39185
Last modified
CVE-2021-39185 is a critical-severity vulnerability rated 9.1/10 on the CVSS scale. Http4s is a minimal, idiomatic Scala interface for HTTP services. In http4s versions 0.21.26 and prior, 0.22.0 through 0.22.2, 0.23.0, 0.23.1, and 1.0.0-M1 through 1.0.0-M24, the default CORS configuration is vulnerable to an origin reflection attack. EPSS estimates a 0.59% chance of exploitation in the next 30 days.
Description
Http4s is a minimal, idiomatic Scala interface for HTTP services. In http4s versions 0.21.26 and prior, 0.22.0 through 0.22.2, 0.23.0, 0.23.1, and 1.0.0-M1 through 1.0.0-M24, the default CORS configuration is vulnerable to an origin reflection attack. The middleware is also susceptible to a Null Origin Attack. The problem is fixed in 0.21.27, 0.22.3, 0.23.2, and 1.0.0-M25. The original `CORS` implementation and `CORSConfig` are deprecated. See the GitHub GHSA for more information, including code examples and workarounds.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Typelevel | Http4s | <= 0.21.26 | — |
| Typelevel | Http4s | >= 0.22.0, <= 0.22.2 | — |
| Typelevel | Http4s | 0.23.0 | — |
| Typelevel | Http4s | 0.23.1 | — |
| Typelevel | Http4s | 1.0.0 | Milestone1 |
References
- https://github.com/http4s/http4s/releases/tag/v0.23.2Third Party Advisory
- https://github.com/http4s/http4s/security/advisories/GHSA-52cf-226f-rhr6Patch, Third Party Advisory
- https://github.com/http4s/http4s/releases/tag/v0.23.2Third Party Advisory
- https://github.com/http4s/http4s/security/advisories/GHSA-52cf-226f-rhr6Patch, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-39185?
How severe is CVE-2021-39185?
How do I fix CVE-2021-39185?
How Strix Helps
- Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-3918json-schema is vulnerable to Improperly Controlled Modificat…9.8
- CVE-2021-39180OpenOLAT is a web-based learning management system (LMS). A …8.8
- CVE-2021-39181OpenOlat is a web-based learning management system (LMS). Pr…8.8
- CVE-2021-39182EnroCrypt is a Python module for encryption and hashing. Pri…7.5
- CVE-2021-39183Owncast is an open source, self-hosted live video streaming …6.1
- CVE-2021-39184Electron is a framework for writing cross-platform desktop a…8.6
- CVE-2021-39186GlobalNewFiles is a MediaWiki extension maintained by Mirahe…6.1
- CVE-2021-39187Parse Server is an open source backend that can be deployed …7.5
- CVE-2021-39189Pimcore is an open source data & experience management platf…5.3
- CVE-2021-3919A potential security vulnerability has been identified in OM…9.8
- CVE-2021-39190The SCCM plugin for GLPI is a plugin to synchronize computer…5.3
- CVE-2021-39191mod_auth_openidc is an authentication/authorization module f…6.1
Are you affected by CVE-2021-39185?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST