GHSA-hxwh-jpp2-84pm
Flask-CORS allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default
At a glance
- Published
- Updated
- CVE
- CVE-2024-6221
- Aliases
- PYSEC-2024-71
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS_V4
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Description
A vulnerability in corydolphin/flask-cors version 4.0.1 allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default, without any configuration option. This behavior can expose private network resources to unauthorized external access, leading to significant security risks such as data breaches, unauthorized access to sensitive information, and potential network intrusions.
Affected packages
| Package | Versions |
|---|---|
| PyPI · flask-cors | introduced 0, fixed 4.0.2 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-6221 ADVISORY
- https://github.com/corydolphin/flask-cors/issues/362 WEB
- https://github.com/corydolphin/flask-cors/pull/363 WEB
- https://github.com/corydolphin/flask-cors/pull/368 WEB
- https://github.com/corydolphin/flask-cors/commit/03aa3f8e2256437f7bad96422a747b98ab5e31bf WEB
- https://github.com/corydolphin/flask-cors/commit/7ae310c56ac30e0b94fb42129aa377bf633256ec WEB
- https://github.com/corydolphin/flask-cors/commit/c8514760cf03fcce16d77f6db7007aad429c4548 WEB
- https://github.com/corydolphin/flask-cors PACKAGE
- https://github.com/corydolphin/flask-cors/releases WEB
- https://github.com/pypa/advisory-database/tree/main/vulns/flask-cors/PYSEC-2024-260.yaml WEB
- https://github.com/pypa/advisory-database/tree/main/vulns/flask-cors/PYSEC-2024-71.yaml WEB
- https://huntr.com/bounties/a42935fc-6f57-4818-bca4-3d528235df4d WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |