Vulnerability · Published Aug 18, 2024 · Assigned by @huntr_ai
CVE-2024-6221Improper Access Control in corydolphin/flask-cors
Medium 6.5
In plain English
A medium-severity improper access control in corydolphin/flask-cors from corydolphin. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A vulnerability in corydolphin/flask-cors version 4.0.1 allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default. This behavior can expose private network resources to unauthorized external access, leading to significant security risks such as data breaches, unauthorized access to sensitive information, and potential network intrusions.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:13 | python-flask-cors | 5.0.0-1 | DEBIAN-CVE-2024-6221 |
| Debian:14 | python-flask-cors | 5.0.0-1 | DEBIAN-CVE-2024-6221 |
| PyPI | flask-cors | no fix listed | PYSEC-2024-260 |
| PyPI | flask-cors | 4.0.2 | PYSEC-2024-71 |
| PyPI | flask-cors | 4.0.2 | GHSA-hxwh-jpp2-84pm |
| Ubuntu:22.04:LTS | python-flask-cors | 3.0.9-2ubuntu0.1 | USN-7612-1 |
| Ubuntu:22.04:LTS | python-flask-cors | 3.0.9-2ubuntu0.1 | UBUNTU-CVE-2024-6221 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| corydolphin | corydolphin/flask-cors | unspecified – before 5.0.0 |
Weakness: CWE-284 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N