Information disclosure in Hackerone Hapi Node Module
CVE-2015-9236
Hapi versions less than 11.0.0 implement CORS incorrectly and allowed for configurations that at best returned inconsistent headers and at worst allowed cross-origin activities that were expected to be forbidden. If the connection has CORS enabled but one route has it off, and the route is not GET, the OPTIONS prefetch request will return the default CORS headers and then the actual request will go through and return no CORS headers. This defeats the purpose of turning CORS on the route.
EPSS: 0.015 (72.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.
Affected products
- Hackerone Hapi Node Module — versions <11.0.0
- Hapijs Hapi
Weakness classification (CWE)
Public proof-of-concept exploits
References
- support@hackerone.com (Third Party Advisory, x_refsource_MISC, Release Notes)
- support@hackerone.com (Patch, Third Party Advisory, x_refsource_MISC)
- support@hackerone.com (Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2015-9236?
- CVE-2015-9236 is a medium-severity vulnerability in Hackerone Hapi Node Module, classified under Improper Access Control. CVSS score: 5.3/10. Published 2018-05-31.
- How severe is CVE-2015-9236?
- Medium severity. CVSS v3 base score is 5.3 out of 10.
- Is CVE-2015-9236 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.