CVE-2024-1681

🗓️ 19 Apr 2024 19:37:27Reported by @huntr_aiType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 367 Views🌐 WEB

Vulnerability in corydolphin/flask-cors allows log injection via crafted GET request

Reporter	Title	Published	Views	Family All 102
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses Flask_Cors-4.0.0-py2.py3-none-any.whl which is vulnerable to CVE-2024-1681	12 Aug 202408:29	–	ibm
IBM Security Bulletins	Security Bulletin: QRadar Advisor With Watson for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	17 Mar 202513:46	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Flask-Cors affects IBM Cloud Pak for Data System 2.0 (CPDS 2.0) [CVE-2024-1681]	17 Mar 202508:22	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Flask_Cors affects IBM Cloud Pak for Data System 1.0(CPDS 1.0)[CVE-2024-1681].	4 May 202518:01	–	ibm
IBM Security Bulletins	Security Bulletin: QRadar Suite Software includes components with multiple known vulnerabilities	17 Jun 202420:14	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - MVI Component uses tar-6.2.0.tgz, Flask_Cors-3.0.10-py2.py3-none-any.whl, bcprov-jdk18on-1.72.jar which are vulnerable to CVE-2024-28863, CVE-2024-1681 and CVE-2024-30171	28 Jan 202522:08	–	ibm
IBM Security Bulletins	Security Bulletin: Log Injection Vulnerability in orydolphin/flask-cors (Debug Logging) affects watsonx.data	8 Apr 202608:45	–	ibm
BDU FSTEC	Flask Framework Output Modification	24 Sep 202500:00	–	bdu_fstec
Chainguard	CVE-2024-1681 vulnerabilities	19 Apr 202420:15	–	cgr
CNNVD	Flask-CORS security vulnerability	19 Apr 202400:00	–	cnnvd

NVD

Node

corydolphin flask-corsMatch4.0.0

[
  {
    "vendor": "corydolphin",
    "product": "corydolphin/flask-cors",
    "versions": [
      {
        "version": "unspecified",
        "status": "affected",
        "versionType": "custom",
        "lessThanOrEqual": "latest"
      }
    ]
  }
]

Source	Link
huntr	www.huntr.com/bounties/25a7a0ba-9fa2-4777-acb6-03e5539bb644
lists	www.lists.debian.org/debian-lts-announce/2025/05/msg00049.html

Parameter	Position	Path	Description	CWE
<path>	path	/<path>	Log injection via CRLF sequences in the request path when log level is set to debug.	CWE-117

17 Jun 2026 07:04Current

6.4Medium risk

Vulners AI Score6.4

CVSS 3.15.3

CVSS 35.3

EPSS0.00579

SSVC

CWE-117