CyberRota Analysis
AI-GeneratedThe Glances monitoring tool prior to version 4.5.6 is vulnerable due to improper handling of CORS origins, allowing untrusted websites to access authenticated REST API data through retained credentials. This could lead to unauthorized data exposure for users who have previously authenticated. Organizations using Glances for system monitoring should prioritize upgrading to version 4.5.6 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, the cors_origins guard in glances/outputs/glances_restful_api.py uses exact list equality instead of wildcard membership, allowing a multi-origin list containing the wildcard to retain cors_credentials and expose authenticated REST API data to an untrusted website visited by a previously authenticated user. This issue is fixed in 4.5.6.