CVE-2024-6844

🗓️ 20 Mar 2025 10:10:51Reported by @huntr_aiType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 218 Views🌐 WEB

Vulnerability in flask-cors allows incorrect CORS matching due to '+' handling in URL paths.

Reporter	Title	Published	Views	Family All 100
IBM Security Bulletins	Security Bulletin: The IBM Maximo Application Suite AI-Service component uses multiple third-party dependencies that contain vulnerabilities associated with multiple CVEs.	2 Feb 202604:22	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Data System (CPDS 1.0) is affected by multiple vulnerabilities due to Flask-Cors	1 Apr 202609:55	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses flask_cors-5.0.1-py3-none-any.whl which is vulnerable to CVE-2024-6866, CVE-2024-6839, CVE-2024-6.	1 Aug 202510:38	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses flask_cors-5.0.1-py3-none-any.whl which is vulnerable to this CVE-2024-6839, CVE-2024-6866 and CVE-2024-6844	1 Aug 202510:29	–	ibm
IBM Security Bulletins	Security Bulletin: Log Injection Vulnerability in orydolphin/flask-cors (Debug Logging) affects watsonx.data	8 Apr 202608:45	–	ibm
BDU FSTEC	Flask CORS Storage	27 Sep 202400:00	–	bdu_fstec
Chainguard	CVE-2024-6844 vulnerabilities	22 May 202501:15	–	cgr
Circl	CVE-2024-6844	23 May 202522:39	–	circl
CNNVD	Flask-CORS security vulnerability	20 Mar 202500:00	–	cnnvd
Cvelist	CVE-2024-6844 Inconsistent CORS Matching Due to Handling of '+' in URL Path in corydolphin/flask-cors	20 Mar 202510:10	–	cvelist

NVD

Node

flask-cors_project flask-corsMatch4.0.1

[
  {
    "vendor": "corydolphin",
    "product": "corydolphin/flask-cors",
    "versions": [
      {
        "version": "unspecified",
        "status": "affected",
        "versionType": "custom",
        "lessThanOrEqual": "latest"
      }
    ]
  }
]

Source	Link
huntr	www.huntr.com/bounties/731a6cd4-d05f-4fe6-8f5b-fe088d7b34e0
lists	www.lists.debian.org/debian-lts-announce/2025/05/msg00049.html

Parameter	Position	Path	Description	CWE
path	path	/<path_containing>+	Inconsistent CORS matching due to the '+' character in URL paths being converted to spaces by unquote_plus, leading to incorrect path normalization.	CWE-346

17 Jun 2026 08:18Current

6.2Medium risk

Vulners AI Score6.2

CVSS 35.3

EPSS0.00319

SSVC

CWE-346

cve-2024-6844 inconsistent cors matching url path security vulnerability unauthorized access