PT-2024-6446

🗓️ 11 May 2024 00:00:00Reported by Positive TechnologiesType

ptsecurity🔗 dbugs.ptsecurity.com👁 1 Views

Vulnerability in flask-cors 4.0.1 allows unauthorized access to private networks, upgrade to 4.0.2.

Reporter	Title	Published	Views	Family All 164
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses Flask_Cors-4.0.0-py2.py3-none-any.whl which is vulnerable to CVE-2024-1681	12 Aug 202408:29	–	ibm
IBM Security Bulletins	Security Bulletin: The IBM Maximo Application Suite AI-Service component uses multiple third-party dependencies that contain vulnerabilities associated with multiple CVEs.	2 Feb 202604:22	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Flask-Cors affects IBM Cloud Pak for Data System 1.0(CPDS 1.0)[CVE-2024-6221].	4 May 202517:52	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Data System (CPDS 1.0) is affected by multiple vulnerabilities due to Flask-Cors	1 Apr 202609:55	–	ibm
IBM Security Bulletins	Security Bulletin: QRadar Advisor With Watson for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	17 Mar 202513:46	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Flask-Cors affects IBM Cloud Pak for Data System 2.0 (CPDS 2.0) [CVE-2024-1681]	17 Mar 202508:22	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Flask_Cors affects IBM Cloud Pak for Data System 1.0(CPDS 1.0)[CVE-2024-1681].	4 May 202518:01	–	ibm
IBM Security Bulletins	Security Bulletin: QRadar Suite Software includes components with multiple known vulnerabilities	17 Jun 202420:14	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Flask-Cors affects IBM Cloud Pak for Data System 2.0 (CPDS 2.0) [CVE-2024-6221]	27 Feb 202512:45	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses flask_cors-5.0.1-py3-none-any.whl which is vulnerable to CVE-2024-6866, CVE-2024-6839, CVE-2024-6.	1 Aug 202510:38	–	ibm

Source	Link
github	www.github.com/corydolphin/flask-cors/commit/7ae310c56ac30e0b94fb42129aa377bf633256ec
ubuntu	www.ubuntu.com/security/CVE-2024-6839
cve	www.cve.mitre.org/cgi-bin/cvename.cgi
cve	www.cve.mitre.org/cgi-bin/cvename.cgi
github	www.github.com/corydolphin/flask-cors/releases
twitter	www.twitter.com/cracbot/status/1826862001605226871
packages	www.packages.debian.org/src:python-flask-cors
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-6221
osv	www.osv.dev/vulnerability/MGASA-2025-0286
osv	www.osv.dev/vulnerability/DEBIAN-CVE-2024-6221

13 Nov 2025 00:00Current

6Medium risk

Vulners AI Score6

CVSS 48.7

CVSS 3.17.5

CVSS 36.5

EPSS0.00637

SSVC

vulnerability flask-cors unauthorized access private network security risk