{"id":"CVE-2014-7193","aliases":["EUVD-2017-0189","GHSA-84fq-6626-w5fg"],"status":"published","title":"CORS Token Disclosure in crumb","description":"The Crumb plugin before 3.0.0 for Node.js does not properly restrict token access in situations where a hapi route handler has CORS enabled, which allows remote attackers to obtain sensitive information, and potentially obtain the ability to spoof requests to non-CORS routes, via a crafted web site that is visited by an application consumer.","severity":{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01367,"percentile":0.72038,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-284"],"published":"2014-12-25T11:00:00Z","modified":"2026-06-17T00:14:32Z","fixes":[{"ecosystem":"npm","package":"crumb","fixed_in":["3.0.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"crumb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0"}]}]},{"source":"osv","ecosystem":"npm","package":"crumb","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.0.0"}]}]}],"products":[{"vendor":"sideway","product":"hapi_crumb"}],"references":[{"url":"https://nodesecurity.io/advisories/crumb_cors_token_disclosure","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"https://github.com/hapijs/crumb/commit/5e6d4f5c81677fe9e362837ffd4a02394303db3c","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-7193","tags":["advisory"]},{"url":"https://github.com/spumko/crumb/commit/5e6d4f5c81677fe9e362837ffd4a02394303db3c","tags":["web"]},{"url":"https://github.com/advisories/GHSA-84fq-6626-w5fg","tags":["advisory"]},{"url":"https://www.npmjs.com/advisories/4","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2014-7193","description":"The Crumb plugin before 3.0.0 for Node.js does not properly restrict token access in situations where a hapi route handler has CORS enabled, which allows remote attackers to obtain sensitive information, and potentially obtain the ability to spoof requests to non-CORS routes, via a crafted web site that is visited by an application consumer.","status":"published","published":"2014-12-25T11:00:00Z","modified":"2024-08-06T12:40:19.196Z","updated_at":"2026-11-02T14:33:46.631905Z"}],"euvd":[{"id":"EUVD-2017-0189","description":"The Crumb plugin before 3.0.0 for Node.js does not properly restrict token access in situations where a hapi route handler has CORS enabled, which allows remote attackers to obtain sensitive information, and potentially obtain the ability to spoof requests to non-CORS routes, via a crafted web site that is visited by an application consumer.","status":"published","published":"2014-12-25T11:00:00Z","modified":"2024-08-06T12:40:19Z","updated_at":"2026-11-03T01:56:55.992719Z"}],"ghsa":[{"id":"GHSA-84fq-6626-w5fg","title":"CORS Token Disclosure in crumb","description":"When CORS is enabled on a hapi route handler, it is possible to set a crumb token for a different domain. An attacker would need to have an application consumer visit a site they control, request a route supporting CORS, and then retrieve the token. With this token, they could possibly make requests to non CORS routes as this user.\n\nA configuration and scenario where this would occur is unlikely, as most configurations will set CORS globally (where crumb is not used), or not at all.\n\n\n## Recommendation\n\nUpdate to version 3.0.0 or greater.","status":"published","published":"2017-10-24T18:33:36Z","modified":"2023-02-01T05:03:27Z","cwes":["CWE-284"],"updated_at":"2026-11-02T14:36:31.364752Z"}],"nvd":[{"id":"CVE-2014-7193","description":"The Crumb plugin before 3.0.0 for Node.js does not properly restrict token access in situations where a hapi route handler has CORS enabled, which allows remote attackers to obtain sensitive information, and potentially obtain the ability to spoof requests to non-CORS routes, via a crafted web site that is visited by an application consumer.","status":"published","published":"2014-12-25T11:59:01.413Z","modified":"2026-06-17T00:14:32.543Z","cvss":[{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:02:57.680258Z"}],"osv":[{"id":"GHSA-84fq-6626-w5fg","title":"CORS Token Disclosure in crumb","description":"When CORS is enabled on a hapi route handler, it is possible to set a crumb token for a different domain. An attacker would need to have an application consumer visit a site they control, request a route supporting CORS, and then retrieve the token. With this token, they could possibly make requests to non CORS routes as this user.\n\nA configuration and scenario where this would occur is unlikely, as most configurations will set CORS globally (where crumb is not used), or not at all.\n\n\n## Recommendation\n\nUpdate to version 3.0.0 or greater.","status":"published","published":"2017-10-24T18:33:36Z","modified":"2023-11-08T03:57:44.6161Z","cwes":["CWE-284"],"updated_at":"2026-11-02T15:46:41.732368Z"}]}}