-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper CORS origin validation() logic in the AllowedOriginValidator function. The pre-patch code checked for literal domain suffixes without subdomain validation (e.g., checking for 'play-with-docker.com' instead of '.play-with-docker.com'). This allowed attacker-controlled domains containing the target domain as a suffix to bypass CORS protections. The commit diff explicitly shows the fix adding leading dots to enforce proper subdomain validation, confirming this function's role in the vulnerability.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/play-with-docker/play-with-docker | go | <= 0.0.2 |