CORS Error

XMLWordPrintable

    • Type: Bug
    • Resolution: Unresolved
    • Priority: Medium
    • 3.6.1
    • Affects Version/s: 3.4.0

      The application is encountering a CORS (Cross-Origin Resource Sharing) error when attempting to access https://uatamrit.piramalswasthya.org/common-api/FeedbacksList?apikey=undefined from a different origin. This prevents legitimate cross-origin requests, which can break functionality such as API calls from frontend applications, third-party integrations, or external scripts.

      Vulnerability Name Vulnerable Point, Port or Parameter CVE/CWE CVSS Score Overall Risk
      (Severity)      		 Mapping with OWASP Testing Checklist Observation / Description Impact Recommendation Reference Steps to reproduce
      CORS https://uatamrit.piramalswasthya.org/common-api/FeedbacksList?apikey=undefined CWE-942 3.7 Low OWASP Configuration and Deploy Management Testing Allowing all origins with * in the CORS (Cross-Origin Resource Sharing) policy is a critical misconfiguration. This enables any external website or domain to send requests and potentially access data from the vulnerable server, dramatically increasing the risk of data theft, unauthorized actions, and exploitation via malicious cross-origin scripts.​ Any remote origin can access exposed API endpoints or resources, leading to data leakage.
       
      Attackers can launch cross-origin attacks, steal sensitive user data, conduct credential theft, and bypass same-origin protections.
       
      If combined with other vulnerabilities (e.g., XSS), full account takeover is possible.      		 Never use * for sensitive APIs or data responses.
       
      Restrict Access-Control-Allow-Origin to trusted, specific domains.
       
      Avoid using Access-Control-Allow-Credentials: true with a wildcard, as this is blocked by modern browsers but still dangerous on legacy systems.      		 https://cwe.mitre.org/data/definitions/942.html Step 1:
      During the security assessment, it was observed using Burp Suite that the server included Access-Control-Allow-Origin: * in its Request headers.

            Assignee:
            Vanitha S
            Reporter:
            Shashank Kharkwal
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

              Created:
              Updated: