GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2019-25211 (GCVE-0-2019-25211)

Vulnerability from cvelistv5 – Published: 2024-06-28 00:00 – Updated: 2025-11-03 18:07
VLAI
Summary
parseWildcardRules in Gin-Gonic CORS middleware before 1.6.0 mishandles a wildcard at the end of an origin string, e.g., https://example.community/* is allowed when the intention is that only https://example.com/* should be allowed, and http://localhost.example.com/* is allowed when the intention is that only http://localhost/* should be allowed.
Severity
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
SSVC
Exploitation: none Automatable: yes Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-07-09 15:33 UTC
CWE
  • n/a
  • CWE-346 - Origin Validation Error
Assigner
References
Impacted products
Vendor Product Version CPE status
gin-contrib cors Affected: 0 , < 1.6.0 (custom)
    cpe:2.3:a:gin-contrib:cors:*:*:*:*:*:*:*:*
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:gin-contrib:cors:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "cors",
            "vendor": "gin-contrib",
            "versions": [
              {
                "lessThan": "1.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 9.1,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2019-25211",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-09T15:33:30.863031Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-346",
                "description": "CWE-346 Origin Validation Error",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-14T18:16:31.181Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T18:07:54.695Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/gin-contrib/cors/pull/57"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/gin-contrib/cors/pull/106"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/gin-contrib/cors/compare/v1.5.0...v1.6.0"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/gin-contrib/cors/releases/tag/v1.6.0"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/gin-contrib/cors/commit/27b723a473efd80d5a498fa9f5933c80204c850d"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00024.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "parseWildcardRules in Gin-Gonic CORS middleware before 1.6.0 mishandles a wildcard at the end of an origin string, e.g., https://example.community/* is allowed when the intention is that only https://example.com/* should be allowed, and http://localhost.example.com/* is allowed when the intention is that only http://localhost/* should be allowed."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-28T23:38:39.161Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/gin-contrib/cors/pull/57"
        },
        {
          "url": "https://github.com/gin-contrib/cors/pull/106"
        },
        {
          "url": "https://github.com/gin-contrib/cors/compare/v1.5.0...v1.6.0"
        },
        {
          "url": "https://github.com/gin-contrib/cors/releases/tag/v1.6.0"
        },
        {
          "url": "https://github.com/gin-contrib/cors/commit/27b723a473efd80d5a498fa9f5933c80204c850d"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2019-25211",
    "datePublished": "2024-06-28T00:00:00.000Z",
    "dateReserved": "2024-06-28T00:00:00.000Z",
    "dateUpdated": "2025-11-03T18:07:54.695Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2019-25211",
      "date": "2026-09-20",
      "epss": "0.00431",
      "percentile": "0.36941"
    },
    "nvd": {
      "cve": {
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "parseWildcardRules in Gin-Gonic CORS middleware before 1.6.0 mishandles a wildcard at the end of an origin string, e.g., https://example.community/* is allowed when the intention is that only https://example.com/* should be allowed, and http://localhost.example.com/* is allowed when the intention is that only http://localhost/* should be allowed."
          },
          {
            "lang": "es",
            "value": "parseWildcardRules en el middleware Gin-Gonic CORS anterior a 1.6.0 maneja mal un comod\u00edn al final de una cadena de origen, por ejemplo, https://example.community/* se permite cuando la intenci\u00f3n es que solo https://example.com/* debe permitirse, y http://localhost.example.com/* est\u00e1 permitido cuando la intenci\u00f3n es que solo se debe permitir http://localhost/*."
          }
        ],
        "id": "CVE-2019-25211",
        "lastModified": "2025-11-03T19:15:39.390",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 9.1,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.2,
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "type": "Secondary"
            }
          ]
        },
        "published": "2024-06-29T00:15:02.107",
        "references": [
          {
            "source": "cve@mitre.org",
            "url": "https://github.com/gin-contrib/cors/commit/27b723a473efd80d5a498fa9f5933c80204c850d"
          },
          {
            "source": "cve@mitre.org",
            "url": "https://github.com/gin-contrib/cors/compare/v1.5.0...v1.6.0"
          },
          {
            "source": "cve@mitre.org",
            "url": "https://github.com/gin-contrib/cors/pull/106"
          },
          {
            "source": "cve@mitre.org",
            "url": "https://github.com/gin-contrib/cors/pull/57"
          },
          {
            "source": "cve@mitre.org",
            "url": "https://github.com/gin-contrib/cors/releases/tag/v1.6.0"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://github.com/gin-contrib/cors/commit/27b723a473efd80d5a498fa9f5933c80204c850d"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://github.com/gin-contrib/cors/compare/v1.5.0...v1.6.0"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://github.com/gin-contrib/cors/pull/106"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://github.com/gin-contrib/cors/pull/57"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://github.com/gin-contrib/cors/releases/tag/v1.6.0"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00024.html"
          }
        ],
        "sourceIdentifier": "cve@mitre.org",
        "vulnStatus": "Awaiting Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-346"
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-03-18T02:38:29+00:00",
      "cve": "CVE-2019-25211",
      "id": "CVE-2019-25211",
      "initial_release_date": "2019-01-01T00:00:00+00:00",
      "product_status:fixed": "1",
      "product_status:known_affected": "10",
      "product_status:known_not_affected": "10",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "github.com/gin-contrib/cors: Gin mishandles a wildcard in the origin string in github.com/gin-contrib/cors",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2019/cve-2019-25211.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2025-11-03T18:07:54.695Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://github.com/gin-contrib/cors/pull/57"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://github.com/gin-contrib/cors/pull/106"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://github.com/gin-contrib/cors/compare/v1.5.0...v1.6.0"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://github.com/gin-contrib/cors/releases/tag/v1.6.0"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://github.com/gin-contrib/cors/commit/27b723a473efd80d5a498fa9f5933c80204c850d"
              },
              {
                "url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00024.html"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "affected": [
              {
                "cpes": [
                  "cpe:2.3:a:gin-contrib:cors:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "cors",
                "vendor": "gin-contrib",
                "versions": [
                  {
                    "lessThan": "1.6.0",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "LOW",
                  "attackVector": "NETWORK",
                  "availabilityImpact": "NONE",
                  "baseScore": 9.1,
                  "baseSeverity": "CRITICAL",
                  "confidentialityImpact": "HIGH",
                  "integrityImpact": "HIGH",
                  "privilegesRequired": "NONE",
                  "scope": "UNCHANGED",
                  "userInteraction": "NONE",
                  "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2019-25211",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-07-09T15:33:30.863031Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "cweId": "CWE-346",
                    "description": "CWE-346 Origin Validation Error",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-07-09T15:37:32.460Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "n/a",
              "vendor": "n/a",
              "versions": [
                {
                  "status": "affected",
                  "version": "n/a"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "parseWildcardRules in Gin-Gonic CORS middleware before 1.6.0 mishandles a wildcard at the end of an origin string, e.g., https://example.community/* is allowed when the intention is that only https://example.com/* should be allowed, and http://localhost.example.com/* is allowed when the intention is that only http://localhost/* should be allowed."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "n/a",
                  "lang": "en",
                  "type": "text"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2024-06-28T23:38:39.161Z",
            "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            "shortName": "mitre"
          },
          "references": [
            {
              "url": "https://github.com/gin-contrib/cors/pull/57"
            },
            {
              "url": "https://github.com/gin-contrib/cors/pull/106"
            },
            {
              "url": "https://github.com/gin-contrib/cors/compare/v1.5.0...v1.6.0"
            },
            {
              "url": "https://github.com/gin-contrib/cors/releases/tag/v1.6.0"
            },
            {
              "url": "https://github.com/gin-contrib/cors/commit/27b723a473efd80d5a498fa9f5933c80204c850d"
            }
          ]
        }
      },
      "cveMetadata": {
        "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "assignerShortName": "mitre",
        "cveId": "CVE-2019-25211",
        "datePublished": "2024-06-28T00:00:00.000Z",
        "dateReserved": "2024-06-28T00:00:00.000Z",
        "dateUpdated": "2025-11-03T18:07:54.695Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.