CVE-2024-6844

🗓️ 20 Mar 2025 10:10:51Reported by @huntr_aiType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 176 Views

Vulnerability in flask-cors allows incorrect CORS matching due to '+' handling in URL paths.

Reporter	Title	Published	Views	Family All 49
IBM Security Bulletins	Security Bulletin: The IBM Maximo Application Suite AI-Service component uses multiple third-party dependencies that contain vulnerabilities associated with multiple CVEs.	2 Feb 202604:22	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Data System (CPDS 1.0) is affected by multiple vulnerabilities due to Flask-Cors	1 Apr 202609:55	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses flask_cors-5.0.1-py3-none-any.whl which is vulnerable to CVE-2024-6866, CVE-2024-6839, CVE-2024-6.	1 Aug 202510:38	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses flask_cors-5.0.1-py3-none-any.whl which is vulnerable to this CVE-2024-6839, CVE-2024-6866 and CVE-2024-6844	1 Aug 202510:29	–	ibm
IBM Security Bulletins	Security Bulletin: Log Injection Vulnerability in orydolphin/flask-cors (Debug Logging) affects watsonx.data	8 Apr 202608:45	–	ibm
Chainguard	CVE-2024-6844 vulnerabilities	22 May 202501:15	–	cgr
Circl	CVE-2024-6844	23 May 202522:39	–	circl
CNNVD	Flask-CORS 安全漏洞	20 Mar 202500:00	–	cnnvd
Cvelist	CVE-2024-6844 Inconsistent CORS Matching Due to Handling of '+' in URL Path in corydolphin/flask-cors	20 Mar 202510:10	–	cvelist
Debian	[SECURITY] [DLA 4197-1] python-flask-cors security update	31 May 202502:30	–	debian

NVD

Node

flask-cors_project flask-corsMatch4.0.1

[
  {
    "vendor": "corydolphin",
    "product": "corydolphin/flask-cors",
    "versions": [
      {
        "version": "unspecified",
        "status": "affected",
        "versionType": "custom",
        "lessThanOrEqual": "latest"
      }
    ]
  }
]

Source	Link
huntr	www.huntr.com/bounties/731a6cd4-d05f-4fe6-8f5b-fe088d7b34e0
lists	www.lists.debian.org/debian-lts-announce/2025/05/msg00049.html

03 Nov 2025 20:17Current

5.5Medium risk

Vulners AI Score5.5

CVSS 35.3

EPSS0.0011

SSVC

CWE-346

cve-2024-6844 inconsistent cors matching url path security vulnerability unauthorized access