CVE-2020-25032High· 7.5▾ TwilightFlask-Cors Directory Traversal vulnerability
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.8 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
4.0%
An issue was discovered in Flask-CORS (aka CORS Middleware for Flask) before 3.0.9. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format.
flask-cors < 3.0.9Upgrade to a patched release:
flask-cors 3.0.9Connected by shared product, vendor, weakness, or advisory.
CVE-2024-1681Medium· 5.3flask-cors vulnerable to log injection when the log level is set to debug
CVE-2024-6221High· 7.5Flask-CORS allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default
CVE-2024-6844Medium· 5.3Flask-CORS allows for inconsistent CORS matching
CVE-2024-6839Medium· 4.3Flask-CORS improper regex path matching vulnerability
CVE-2024-6866Medium· 5.3Flask-CORS vulnerable to Improper Handling of Case Sensitivity