Vulnerability · Published Mar 20, 2025 · Assigned by @huntr_ai
CVE-2024-6844Inconsistent CORS Matching Due to Handling of '+' in URL Path in corydolphin/flask-cors
Medium 5.3
In plain English
A medium-severity security flaw in corydolphin/flask-cors from corydolphin. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A vulnerability in corydolphin/flask-cors version 4.0.1 allows for inconsistent CORS matching due to the handling of the '+' character in URL paths. The request.path is passed through the unquote_plus function, which converts the '+' character to a space ' '. This behavior leads to incorrect path normalization, causing potential mismatches in CORS configuration. As a result, endpoints may not be matched correctly to their CORS settings, leading to unexpected CORS policy application. This can cause unauthorized cross-origin access or block valid requests, creating security vulnerabilities and usability issues.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | python-flask-cors | 3.0.10-2+deb12u1 | DEBIAN-CVE-2024-6844 |
| Debian:13 | python-flask-cors | 6.0.0-1 | DEBIAN-CVE-2024-6844 |
| Debian:14 | python-flask-cors | 6.0.0-1 | DEBIAN-CVE-2024-6844 |
| PyPI | flask-cors | 6.0.0 | GHSA-8vgw-p6qm-5gr7 |
| PyPI | flask-cors | 6.0.0 | PYSEC-2026-1385 |
| Ubuntu:22.04:LTS | python-flask-cors | 3.0.9-2ubuntu0.1 | USN-7612-1 |
| Ubuntu:22.04:LTS | python-flask-cors | 3.0.9-2ubuntu0.1 | UBUNTU-CVE-2024-6844 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| corydolphin | corydolphin/flask-cors | unspecified – through latest |
Weakness: CWE-346 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N