CVE-2024-6221: fallo de gravedad media en corydolphin/flask-cors
Improper Access Control in corydolphin/flask-cors
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.5epss 0.7%
A vulnerability in corydolphin/flask-cors version 4.0.1 allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default. This behavior can expose private network resources to unauthorized external access, leading to significant security risks such as data breaches, unauthorized access to sensitive information, and potential network intrusions.
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Productos afectados
corydolphin · corydolphin/flask-corsCVEs relacionadas — corydolphin/flask-cors
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-6839MEDIUMImproper Regex Path Matching in corydolphin/flask-corsEPSS 0.7%CVE-2024-6866MEDIUMCase-Insensitive Path Matching in corydolphin/flask-corsEPSS 0.7%CVE-2024-1681MEDIUMLog Injection Vulnerability in corydolphin/flask-corsEPSS 0.6%CVE-2024-6844MEDIUMInconsistent CORS Matching Due to Handling of '+' in URL Path in corydolphin/flask-corsEPSS 0.3%