CVE-2015-9236: Infoleak
Hapi versions less than 11.0.0 implement CORS incorrectly and allowed for configurations that at best returned inconsistent headers and at worst allowed cross-origin activities that were expected to be forbidden. If the connection has CORS enabled but one route has it off, and the route is not GET, the OPTIONS prefetch request will return the default CORS headers and then the actual request will go through and return no CORS headers. This defeats the purpose of turning CORS on the route.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2015-9236?
CVE-2015-9236 is classified as a medium severity vulnerability due to potential cross-origin resource sharing (CORS) issues.
How do I fix CVE-2015-9236?
To fix CVE-2015-9236, upgrade the Hapi framework to version 11.0.0 or later.
Which versions of Hapi are affected by CVE-2015-9236?
CVE-2015-9236 affects all Hapi versions prior to 11.0.0.
What are the implications of CVE-2015-9236 on my application?
CVE-2015-9236 can lead to inconsistent CORS headers and unauthorized cross-origin activities, compromising application security.
Is CORS enabled by default in Hapi versions before 11.0.0 related to CVE-2015-9236?
Yes, CORS was implemented incorrectly by default in Hapi versions before 11.0.0, which is the core issue of CVE-2015-9236.