CVE-2024-6221

2024-08-1819:15:04

CWE-284

@huntr_ai

web.nvd.nist.gov

vulnerability

flask-cors

version 4.0.1

default setting

access-control-allow-private-network

potential network intrusions

data breaches

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

6.5

Confidence

High

EPSS

0.001

Percentile

36.5%

JSON

A vulnerability in corydolphin/flask-cors version 4.0.1 allows the Access-Control-Allow-Private-Network CORS header to be set to true by default, without any configuration option. This behavior can expose private network resources to unauthorized external access, leading to significant security risks such as data breaches, unauthorized access to sensitive information, and potential network intrusions.

Affected configurations

Nvd

Vulnrichment

Node

corydolphinflask-corsMatch4.0.1

VendorProductVersionCPE
corydolphinflask-cors4.0.1cpe:2.3:a:corydolphin:flask-cors:4.0.1:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
corydolphin	flask-cors	4.0.1	cpe:2.3:a:corydolphin:flask-cors:4.0.1:::::::*

CNA Affected

[
  {
    "vendor": "corydolphin",
    "product": "corydolphin/flask-cors",
    "versions": [
      {
        "version": "unspecified",
        "status": "affected",
        "versionType": "custom",
        "lessThanOrEqual": "latest"
      }
    ]
  }
]