CVE-2024-6844 Inconsistent CORS Matching Due to Handling of '+' in URL Path in corydolphin/flask-cors

🗓️ 20 Mar 2025 10:10:51Reported by @huntr_aiType

Vulnerability in flask-cors due to '+' handling in URLs causing mismatched CORS configurations.

Reporter	Title	Published	Views	Family All 51
IBM Security Bulletins	Security Bulletin: The IBM Maximo Application Suite AI-Service component uses multiple third-party dependencies that contain vulnerabilities associated with multiple CVEs.	2 Feb 202604:22	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Data System (CPDS 1.0) is affected by multiple vulnerabilities due to Flask-Cors	1 Apr 202609:55	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses flask_cors-5.0.1-py3-none-any.whl which is vulnerable to CVE-2024-6866, CVE-2024-6839, CVE-2024-6.	1 Aug 202510:38	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses flask_cors-5.0.1-py3-none-any.whl which is vulnerable to this CVE-2024-6839, CVE-2024-6866 and CVE-2024-6844	1 Aug 202510:29	–	ibm
IBM Security Bulletins	Security Bulletin: Log Injection Vulnerability in orydolphin/flask-cors (Debug Logging) affects watsonx.data	8 Apr 202608:45	–	ibm
BDU FSTEC	The vulnerability of Flask’s CORS storage library in Python PyPi products allows attackers to circumvent existing security restrictions.	27 Sep 202400:00	–	bdu_fstec
Chainguard	CVE-2024-6844 vulnerabilities	22 May 202501:15	–	cgr
Circl	CVE-2024-6844	23 May 202522:39	–	circl
CNNVD	Flask-CORS 安全漏洞	20 Mar 202500:00	–	cnnvd
CVE	CVE-2024-6844	20 Mar 202510:10	–	cve

[
  {
    "vendor": "corydolphin",
    "product": "corydolphin/flask-cors",
    "versions": [
      {
        "version": "unspecified",
        "status": "affected",
        "versionType": "custom",
        "lessThanOrEqual": "latest"
      }
    ]
  }
]

Source	Link
huntr	www.huntr.com/bounties/731a6cd4-d05f-4fe6-8f5b-fe088d7b34e0

15 Oct 2025 12:50Current

CVSS 35.3

EPSS0.0011

CWE-346