GitHub Advisoryadvisory · PyPI
GHSA-hxwh-jpp2-84pm Flask-CORS allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default
HIGH
Official page ↗
- Aliases
- CVE-2024-6221
- Ecosystem
- PyPI
- Packages
- Flask-Cors
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-284
- Reviewed
- 2024-08-19
Affected packages
• PyPI Flask-Cors: < 4.0.2 → fixed in 4.0.2
Description
A vulnerability in corydolphin/flask-cors version 4.0.1 allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default, without any configuration option. This behavior can expose private network resources to unauthorized external access, leading to significant security risks such as data breaches, unauthorized access to sensitive information, and potential network intrusions.
Related
Alias · CVE (1)
- CVE-2024-6221 A vulnerability in corydolphin/flask-cors version 4.0.1 allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by… vulnerability
Weakness · CWE (1)
- CWE-284 Improper Access Control weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-6221 advisory
- https://github.com/corydolphin/flask-cors/issues/362 web
- https://github.com/corydolphin/flask-cors/pull/363 web
- https://github.com/corydolphin/flask-cors/pull/368 web
- https://github.com/corydolphin/flask-cors/commit/03aa3f8e2256437f7bad96422a747b98ab5e31bf web
- https://github.com/corydolphin/flask-cors/commit/7ae310c56ac30e0b94fb42129aa377bf633256ec web
- https://github.com/corydolphin/flask-cors/commit/c8514760cf03fcce16d77f6db7007aad429c4548 web
- https://github.com/corydolphin/flask-cors package
- https://github.com/corydolphin/flask-cors/releases web
- https://github.com/pypa/advisory-database/tree/main/vulns/flask-cors/PYSEC-2024-260.yaml web
- https://github.com/pypa/advisory-database/tree/main/vulns/flask-cors/PYSEC-2024-71.yaml web
- https://huntr.com/bounties/a42935fc-6f57-4818-bca4-3d528235df4d web