Information disclosure in HackerOne Hapi Node Module
CVE-2015-9236
Hapi versions less than 11.0.0 implement CORS incorrectly and allowed for configurations that at best returned inconsistent headers and at worst allowed cross-origin activities that were expected to be forbidden. If the connection has CORS enabled but one route has it off, and the route is not GET, the OPTIONS prefetch request will return the default CORS headers and then the actual request will go through and return no CORS headers. This defeats the purpose of turning CORS on the route.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.
EPSS exploit prediction
EPSS: 0.015 (73.9th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 74th percentile — 73.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.015 · newest: 0.015 · change: 0.000
Affected products
- HackerOne Hapi Node Module — versions <11.0.0
- Hapijs Hapi
Weakness classification (CWE)
Public proof-of-concept exploits
References
- github.com/hapijs/hapi/issues/2850 (Third Party Advisory, Release Notes)
- github.com/hapijs/hapi/issues/2840 (Patch, Third Party Advisory)
- nodesecurity.io/advisories/45 (Third Party Advisory)
Frequently asked questions
- What is CVE-2015-9236?
- CVE-2015-9236 is a medium-severity vulnerability in HackerOne Hapi Node Module, classified under Improper Access Control. CVSS score: 5.3/10. Published 2018-05-31.
- How severe is CVE-2015-9236?
- Medium severity. CVSS v3 base score is 5.3 out of 10.
- Is CVE-2015-9236 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.