CWE-942: Permissive Cross-domain Security Policy with Untrusted Domains
The product uses a web-client protection mechanism such as a Content Security Policy (CSP) or cross-domain policy file, but the policy includes untrusted domains with which the web client is allowed to communicate.
A kind of CWE-863 Incorrect Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- mozilla firefox, firefox esr, thunderbird +2 moreA malicious website could have learned the size of a cross-origin resource that supported Range...9.8 Critical
- monospace directusInsecure default value for CORS configuration9.8 Critical
- schneider-electric hmibscea53d1edb firmware, hmibscea53d1edl firmware, hmibscea53d1edm firmware +4 more +6 moreA CWE-942: Permissive Cross-domain Policy with Untrusted Domains vulnerability exists that could...8.8 High
- eclipse theia, the eclipse foundation eclipse theia +1 moreRemote code execution in Eclipse Theia8.8 High
- [unknown] syndesis, redhat fuse +1 moreIt was found that the Syndesis configuration for Cross-Origin Resource Sharing was set to allow...7.4 High