CVE-2024-6221 Improper Access Control in corydolphin/flask-cors

2024-08-1818:58:20

CWE-284

@huntr_ai

www.cve.org

cve-2024-6221

vulnerability

access control

cors header

private network

data breaches

unauthorized access

security risks

network intrusions

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

EPSS

0.001

Percentile

36.5%

JSON

A vulnerability in corydolphin/flask-cors version 4.0.1 allows the Access-Control-Allow-Private-Network CORS header to be set to true by default, without any configuration option. This behavior can expose private network resources to unauthorized external access, leading to significant security risks such as data breaches, unauthorized access to sensitive information, and potential network intrusions.

CNA Affected

[
  {
    "vendor": "corydolphin",
    "product": "corydolphin/flask-cors",
    "versions": [
      {
        "version": "unspecified",
        "status": "affected",
        "versionType": "custom",
        "lessThanOrEqual": "latest"
      }
    ]
  }
]