Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact In Sails apps <=v1.5.6, an attacker can send a virtual request that will cause the node process to crash. Patches This behavior was fixed in Sails v1.5.7 Workarounds Disable the sockets hook and remove the sails.io.js client References https://github.com/balderdashy/sails/pull/7287 Big thanks to @ThomasRinsma at Codean!
Recommended action: Upgrade to 1.5.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Affected versions of sails have an issue with the CORS configuration where the value of the origin header is reflected as the value for the Access-Control-Allow-Origin header. This may allow an attacker to make AJAX requests to vulnerable hosts through cross-site scripting or a malicious HTML Document, effectively bypassing the Same Origin Policy. Mitigating Factors This is only an issue when allRoutes is set to true and origin is set to or left commented out in the sails CORS config file. The problem can be compounded when the cors credentials setting is not provided, because at that point authenticated cross domain requests are possible. Recommendation Update to version 0.12.7 or later. As this vulnerability is primarily a user error, the patch for the vulnerability will simply cause the application to write an error message to the console when a vulnerable configuration is used in a production environment. Writing a proper CORS configuration is still the responsibility of the…
Recommended action: Upgrade to 0.12.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.