CVE-2024-6221mediumCWE-284

CVE-2024-6221: medium-severity vulnerability in corydolphin/flask-cors

Improper Access Control in corydolphin/flask-cors

Published · Updated

Follow this CVE+ Monitor corydolphin/flask-cors+ Monitor python-flask-cors

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.5epss 0.7%
A vulnerability in corydolphin/flask-cors version 4.0.1 allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default. This behavior can expose private network resources to unauthorized external access, leading to significant security risks such as data breaches, unauthorized access to sensitive information, and potential network intrusions.
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Affected products
corydolphin · corydolphin/flask-cors
Related CVEs — corydolphin/flask-cors

In the same product, most dangerous first.

CVE-2024-6839MEDIUMImproper Regex Path Matching in corydolphin/flask-corsEPSS 0.7%CVE-2024-6866MEDIUMCase-Insensitive Path Matching in corydolphin/flask-corsEPSS 0.7%CVE-2024-1681MEDIUMLog Injection Vulnerability in corydolphin/flask-corsEPSS 0.6%CVE-2024-6844MEDIUMInconsistent CORS Matching Due to Handling of '+' in URL Path in corydolphin/flask-corsEPSS 0.3%