Threats tagged 'ghsa-cw46-9gf7-56p5'

A vulnerability in Tidewave versions from 0.8.0 before 0.9.2 allows an attacker to read filesystem path names of the application via the /tidewave/connect endpoint or the rendered toolbar. This occurs because the responses do not validate the Host header, enabling a web page that rebinds its domain to the loopback address to perform same-origin requests and access sensitive path information. The disclosed paths can reveal local usernames and project layout details. The issue has a low severity rating with a CVSS score of 2.3.