Skip to content
OpenAdvisories

Weakness (CWE)

CWE-942: Permissive Cross-domain Security Policy with Untrusted Domains

Variant Incomplete

The product uses a web-client protection
mechanism such as a Content Security Policy (CSP) or
cross-domain policy file, but the policy includes untrusted
domains with which the web client is allowed to
communicate.

How to prevent it (3 mitigations)

  1. Architecture and Design, Operation

    Define a restrictive Content Security Policy [REF-1486] or cross-domain policy file.

  2. Architecture and Design, Operation

    Avoid using wildcards in the CSP / cross-domain policy file. Any domain matching the wildcard expression will be implicitly trusted, and can perform two-way interaction with the target server.

  3. Architecture and Design, Operation

    For Flash, modify crossdomain.xml to use meta-policy options such as 'master-only' or 'none' to reduce the possibility of an attacker planting extraneous cross-domain policy files on a server.

Source: MITRE CWE-942

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Medium 4.3
    CVE-2026-85313 Public exploit

    Apache Camel: Camel-Jetty Cross-Origin Credential Exposure via Allow-All CrossOriginFilter Defaults When enableCORS Is Set

    Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Jetty component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. Setting enableCORS on a Jetty endpoint installed Jetty's CrossOriginFilt…

    Apache Software Foundation Apache Camel
  • Medium 6.5
    CVE-2026-84176 Public exploit

    Apache Camel: Camel-Platform-HTTP-Vertx Cross-Origin Credential Exposure via Wildcard Origin Reflection

    Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Platform HTTP Vertx component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. createCorsHandler() set Access-Control-Allow-Credentials: …

    Apache Software Foundation Apache Camel
  • Medium 5.9
    CVE-2026-34227 Public exploit

    Sliver One-Click Remote Access: Insecure CORS & Unauthenticated MCP Interface

    Sliver is a command and control framework that uses a custom Wireguard netstack. Prior to version 1.7.4, a single click on a malicious link gives an unauthenticated attacker immediate, silent control over every active C2 session or beacon, capable of exfiltra…

    BishopFox sliver github.com/bishopfox/sliver Go
  • Medium 6.5
    CVE-2025-55462 Public exploit

    A CORS misconfiguration in Eramba Community and Enterprise Editions v3.26.0 allows an attacker-controlled Origin header…