GHSA-4946-85pr-fvxh

vantage6's CORS settings overly permissive

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-23823

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	vantage6	< 4.3.0	4.3.0

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact The vantage6 server has no restrictions on CORS settings. It should be possible for people to set the allowed origins of the server. The impact is limited because v6 does not use session cookies ### Patches No ### Workarounds No

References

External links from the advisory. They lead to third-party sites.

https://github.com/vantage6/vantage6/security/advisories/GHSA-4946-85pr-fvxh web
https://nvd.nist.gov/vuln/detail/CVE-2024-23823 advisory
https://github.com/vantage6/vantage6/commit/70bb4e1d889230a841eb364d6c03accd7dd01a41 web
https://github.com/vantage6/vantage6 package