CVE-2025-27518CWE-79

Cognita CORS misconfiguration in backend API server

Medium · published March 7, 2025

CVSS v4.0
6.9
EPSS
0%
Percentile
41.5
In the wild
Unconfirmed
What it is

Cognita is a RAG (Retrieval Augmented Generation) Framework for building modular, open source applications for production by TrueFoundry. An insecure CORS configuration in the Cognita backend server allows arbitrary websites to send cross site requests to the application. This vulnerability is fixed in commit 75079c3d3cf376381489b9a82ee46c69024e1a15.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
EPSS
0.00494 · 41.5th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-03-07T15:36Z
EPSS history
Timeline
  • 07 MAR 15:36Z
    Cognita CORS misconfiguration in backend API server
    cvelistv5