Threats tagged 'ghsa-gfc2-9qmw-w7vh'

Glances versions prior to 4.5.4 expose a REST API endpoint (/api/4/all) without authentication and with a permissive CORS policy allowing any origin. This enables malicious websites to read sensitive system information from a victim's browser, including process lists, system details, memory, disk usage, and network configuration. The vulnerability requires only that the victim visits a malicious web page while running Glances in web mode. A fix is available in version 4.5.4.