{"cve":"CVE-2016-10549","nvd":{"published":"2018-05-31T20:29:01.830","modified":"2026-06-17T00:39:55.103","status":"Modified","description":"Sails is an MVC style framework for building realtime web applications. Version 0.12.7 and lower have an issue with the CORS configuration where the value of the origin header is reflected as the value for the Access-Control-Allow-Origin header. This would allow an attacker to make AJAX requests to vulnerable hosts through cross site scripting or a malicious HTML Document, effectively bypassing the Same Origin Policy. Note that this is only an issue when `allRoutes` is set to `true` and `origin` is set to `*` or left commented out in the sails CORS config file. The problem can be compounded when the cors `credentials` setting is not provided. At that point authenticated cross domain requests are possible.","cvss_v4":null,"cvss_v3":{"version":"3.0","vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N","score":4.4},"cwes":["CWE-79","CWE-284"],"references":["http://sailsjs.org/documentation/concepts/security/cors","http://sailsjs.org/documentation/reference/configuration/sails-config-cors","https://nodesecurity.io/advisories/148","http://sailsjs.org/documentation/concepts/security/cors","http://sailsjs.org/documentation/reference/configuration/sails-config-cors"],"products":["sailsjs:sails"],"source":"nvd","synced_at":"2026-10-19T20:50:40.212176939+00:00"},"epss":{"cve":"CVE-2016-10549","score":0.00636,"percentile":0.50495,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-qmv4-jgp7-mf68","url":"https://osv.dev/vulnerability/GHSA-qmv4-jgp7-mf68","summary":"Sails before 0.12.7 vulnerable to Broken CORS","modified":"2023-11-08T03:58:11.949348Z","packages":[{"ecosystem":"npm","name":"sails","purl":"pkg:npm/sails","ranges":["<0.12.7"],"fixed":["0.12.7"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}