GHSA-84PR-M4JR-85G5 flask-cors vulnerable to log injection when the log level is set to debug

🗓️ 19 Apr 2024 21:31:08Reported by GoogleType

osv🔗 osv.dev👁 2 Views

Corydolphin flask-cors is vulnerable to log injection at debug level via CRLF sequence in the request path.

Reporter	Title	Published	Views	Family All 54
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses Flask_Cors-4.0.0-py2.py3-none-any.whl which is vulnerable to CVE-2024-1681	12 Aug 202408:29	–	ibm
IBM Security Bulletins	Security Bulletin: QRadar Advisor With Watson for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	17 Mar 202513:46	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Flask-Cors affects IBM Cloud Pak for Data System 2.0 (CPDS 2.0) [CVE-2024-1681]	17 Mar 202508:22	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Flask_Cors affects IBM Cloud Pak for Data System 1.0(CPDS 1.0)[CVE-2024-1681].	4 May 202518:01	–	ibm
IBM Security Bulletins	Security Bulletin: QRadar Suite Software includes components with multiple known vulnerabilities	17 Jun 202420:14	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - MVI Component uses tar-6.2.0.tgz, Flask_Cors-3.0.10-py2.py3-none-any.whl, bcprov-jdk18on-1.72.jar which are vulnerable to CVE-2024-28863, CVE-2024-1681 and CVE-2024-30171	28 Jan 202522:08	–	ibm
IBM Security Bulletins	Security Bulletin: Log Injection Vulnerability in orydolphin/flask-cors (Debug Logging) affects watsonx.data	8 Apr 202608:45	–	ibm
BDU FSTEC	The vulnerability of the Flask framework, related to improper handling of output data for registration logs, allows a hacker to modify data within the system.	24 Sep 202500:00	–	bdu_fstec
Chainguard	CVE-2024-1681 vulnerabilities	19 Apr 202420:15	–	cgr
CNNVD	Flask-CORS 安全漏洞	19 Apr 202400:00	–	cnnvd

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-1681
github	www.github.com/corydolphin/flask-cors
github	www.github.com/corydolphin/flask-cors/blob/40acc8092332dfed4bb54d7a4f89a6d479466de7/flask_cors/extension.py
github	www.github.com/pypa/advisory-database/tree/main/vulns/flask-cors/PYSEC-2024-271.yaml
huntr	www.huntr.com/bounties/25a7a0ba-9fa2-4777-acb6-03e5539bb644
lists	www.lists.debian.org/debian-lts-announce/2025/05/msg00049.html

05 Jun 2026 18:00Current

6.5Medium risk

Vulners AI Score6.5

CVSS 35.3

EPSS0.00574