Aastha Aggarwal

**Name of the Vulnerable Software and Affected Versions** Apache Helix versions prior to 2.0.1 **Description** Permissive Cross-Origin Resource Sharing (CORS) in the REST API (helix-rest, `org.apache.helix.rest.server.filters.CORSFilter`) allows a remote attacker controlling a web page visited by an authorized user to read responses from and issue cross-origin requests to administrative REST endpoints. This occurs because the filter unconditionally returns `Access-Control-Allow-Origin: *` combined with `Access-Control-Allow-Credentials: true` and reflects arbitrary `Access-Control-Request-Method` and `Access-Control-Request-Headers` values in preflight responses. CORS is a mechanism that allows restricted resources on a web page to be requested from another domain outside the domain from which the first resource was served. **Recommendations** Upgrade to version 2.0.1.