CVE-2024-6844mediumCWE-346

CVE-2024-6844: medium-severity vulnerability in corydolphin/flask-cors

Inconsistent CORS Matching Due to Handling of '+' in URL Path in corydolphin/flask-cors

Published · Updated

Follow this CVE+ Monitor corydolphin/flask-cors+ Monitor python-flask-cors

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 0.3%
A vulnerability in corydolphin/flask-cors version 4.0.1 allows for inconsistent CORS matching due to the handling of the '+' character in URL paths. The request.path is passed through the unquote_plus function, which converts the '+' character to a space ' '. This behavior leads to incorrect path normalization, causing potential mismatches in CORS configuration. As a result, endpoints may not be matched correctly to their CORS settings, leading to unexpected CORS policy application. This can cause unauthorized cross-origin access or block valid requests, creating security vulnerabilities and usability issues.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
corydolphin · corydolphin/flask-cors
Related CVEs — corydolphin/flask-cors

In the same product, most dangerous first.

CVE-2024-6839MEDIUMImproper Regex Path Matching in corydolphin/flask-corsEPSS 0.7%CVE-2024-6866MEDIUMCase-Insensitive Path Matching in corydolphin/flask-corsEPSS 0.7%CVE-2024-6221MEDIUMImproper Access Control in corydolphin/flask-corsEPSS 0.7%CVE-2024-1681MEDIUMLog Injection Vulnerability in corydolphin/flask-corsEPSS 0.6%