CVE-2024-6844Medium· 5.3▾ SunlitFlask-CORS allows for inconsistent CORS matching
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
0.3%
Last analysed / modified upstream
0.3% → 0.3%
A vulnerability in corydolphin/flask-cors version 5.0.1 allows for inconsistent CORS matching due to the handling of the '+' character in URL paths. The request.path is passed through the unquote_plus function, which converts the '+' character to a space ' '. This behavior leads to incorrect path normalization, causing potential mismatches in CORS configuration. As a result, endpoints may not be matched correctly to their CORS settings, leading to unexpected CORS policy application. This can cause unauthorized cross-origin access or block valid requests, creating security vulnerabilities and usability issues.
flask-cors < 6.0.0Upgrade to a patched release:
flask-cors 6.0.0Connected by shared product, vendor, weakness, or advisory.
CVE-2024-1681Medium· 5.3flask-cors vulnerable to log injection when the log level is set to debug
CVE-2024-6839Medium· 4.3Flask-CORS improper regex path matching vulnerability
CVE-2024-6866Medium· 5.3Flask-CORS vulnerable to Improper Handling of Case Sensitivity
CVE-2020-25032High· 7.5Flask-Cors Directory Traversal vulnerability
CVE-2024-6221High· 7.5Flask-CORS allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default