Lookup for vulnerabilities affecting packages.
| Vulnerability_id | VCID-ejzh-a8zs-f3as |
|---|
| Summary | Altium 365 workspace endpoints were configured with an overly permissive Cross-Origin Resource Sharing (CORS) policy that allowed credentialed cross-origin requests from other Altium-controlled subdomains, including forum.live.altium.com. As a result, JavaScript executing on those origins could access authenticated workspace APIs in the context of a logged-in user. When chained with vulnerabilities in those external applications, this misconfiguration enables unauthorized access to workspace data, administrative actions, and bypass of IP allowlisting controls, including in GovCloud environments. |
|---|
| Aliases |
|
|---|
| Fixed_packages |
|
|---|
| Affected_packages |
|
|---|
| References |
|
|---|
| Weaknesses |
| 0 |
| cwe_id |
284 |
| name |
Improper Access Control |
| description |
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
|
| 1 |
| cwe_id |
942 |
| name |
Permissive Cross-domain Policy with Untrusted Domains |
| description |
The product uses a cross-domain policy file that includes domains that should not be trusted. |
|
|
|---|
| Exploits |
|
|---|
| Severity_range_score | 9.0 - 9.0 |
|---|
| Exploitability | null |
|---|
| Weighted_severity | null |
|---|
| Risk_score | null |
|---|
| Resource_url | http://public2.vulnerablecode.io/vulnerabilities/VCID-ejzh-a8zs-f3as |
|---|