Description

A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/setup endpoint. The endpoint implements an insecure CORS policy that reflects any Origin header and enables Access-Control-Allow-Credentials: true, permitting arbitrary external domains to make authenticated requests.

Related CPE's

Could not find any relations

References

Weaknesses

Could not find any weaknesses

CVSS impact metrics

Could not find any metrics

Information