CVE-2014-7193
sideway hapi crumb: no CVSS score yet. EPSS 1.4% chance of exploitation in the next 30 days. Fixed in crumb 3.0.0.
The Crumb plugin before 3.0.0 for Node.js does not properly restrict token access in situations where a hapi route handler has CORS enabled, which allows remote attackers to obtain sensitive information, and potentially obtain the ability to spoof requests to non-CORS routes, via a crafted web site that is visited by an application consumer.
- EPSS
- 1.4% chance of exploitation in the next 30 days; higher than 71% of CVEs (scores of 2026-10-31)
- CWE
- CWE-284
- Published
- Modified
- Record from
- the NVD, synced
Affected
- sideway:hapi_crumb
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-84fq-6626-w5fg | npm | crumb | <3.0.0 | 3.0.0 |