Vulnerability · Published Aug 31, 2020 · Assigned by mitre
CVE-2020-25032
High 7.5
In plain English
A high-severity security flaw in the python-flask-cors package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.9% (higher than 90% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.5High
Exploit odds (30 days)3.9%top 9.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
An issue was discovered in Flask-CORS (aka CORS Middleware for Flask) before 3.0.9. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | python-flask-cors | 3.0.9-1 | DEBIAN-CVE-2020-25032 |
| Debian:13 | python-flask-cors | 3.0.9-1 | DEBIAN-CVE-2020-25032 |
| Debian:14 | python-flask-cors | 3.0.9-1 | DEBIAN-CVE-2020-25032 |
| PyPI | flask-cors | 3.0.9 | GHSA-xc3p-ff3m-f46v |
| PyPI | flask-cors | 3.0.9 | PYSEC-2020-43 |
Affected products (as reported)
References
- https://github.com/corydolphin/flask-cors/releases/tag/3.0.9 x_refsource_MISC
- openSUSE-SU-2020:1393 vendor-advisory, x_refsource_SUSE
- openSUSE-SU-2020:1415 vendor-advisory, x_refsource_SUSE
- openSUSE-SU-2020:1423 vendor-advisory, x_refsource_SUSE
- openSUSE-SU-2020:1446 vendor-advisory, x_refsource_SUSE
- DSA-4775 vendor-advisory, x_refsource_DEBIAN