<?xml version="1.0" encoding="UTF-8"?>
<alert>
<title>Insecure Cross-Origin Resource Access Control </title>

<class>Information</class>
<severity>High</severity>
<discussion>
Vega has detected that the resource has set an insecure Cross-Origin Resource Sharing (CORS) access control. CORS provides mechanisms that allow a server to restrict resource access for cross-site requests to certain trusted domains. The server in question has allowed resource from any origin by setting the value of the "Access-Control-Allow-Origin" response header to a wildcard value. This presents a security risk because any site can issue requests to access resources, regardless of origin.
</discussion>
        <remediation>
          Set the "Access-Control-Allow-Origin" response header to allow access from trusted domains only. Do not allow access from arbitrary domains. 
        </remediation>
        <references>
                <url address="https://developer.mozilla.org/en-US/docs/HTTP/Access_control_CORS">HTTP access control (CORS)</url>
        </references>
</alert>
