Homepage
About Snyk

Information Exposure Affecting com.walmartlabs.concord.server:concord-server-impl package, versions [,1.44.0)

0.0
medium

Snyk CVSS

    Attack Complexity Low

    Threat Intelligence

    EPSS 0.2% (58th percentile)
Expand this section
NVD
7.5 high

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-JAVA-COMWALMARTLABSCONCORDSERVER-560360
  • published 15 Mar 2020
  • disclosed 15 Mar 2020
  • credit Rob Fitzpatrick
Report a new vulnerability Found a mistake?

Introduced: 15 Mar 2020

CVE-2020-10591 Open this link in a new tab
CWE-213 Open this link in a new tab

How to fix?

Upgrade com.walmartlabs.concord.server:concord-server-impl to version 1.44.0 or higher.

Overview

com.walmartlabs.concord.server:concord-server-impl is a workflow server. It is the orchestration engine that connects different systems together using scenarios and plugins created by users.

Affected versions of this package are vulnerable to Information Exposure. CORS Access-Control-Allow-Origin headers have a potentially unsafe dependency on Origin headers, and are not configurable. This allows remote attackers to discover host information, nodes, API metadata, and references to usernames via api/v1/apikey.