PYSEC-2024-271

🗓️ 19 Apr 2024 20:15:09Reported by Python Packaging AdvisoryType

pypa🔗 github.com👁 23 Views

Flask CORS vulnerability allows log injection via CRLF in request path when debug logging is enabled.

Reporter	Title	Published	Views	Family All 100
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses Flask_Cors-4.0.0-py2.py3-none-any.whl which is vulnerable to CVE-2024-1681	12 Aug 202408:29	–	ibm
IBM Security Bulletins	Security Bulletin: QRadar Advisor With Watson for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	17 Mar 202513:46	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Flask-Cors affects IBM Cloud Pak for Data System 2.0 (CPDS 2.0) [CVE-2024-1681]	17 Mar 202508:22	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Flask_Cors affects IBM Cloud Pak for Data System 1.0(CPDS 1.0)[CVE-2024-1681].	4 May 202518:01	–	ibm
IBM Security Bulletins	Security Bulletin: QRadar Suite Software includes components with multiple known vulnerabilities	17 Jun 202420:14	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - MVI Component uses tar-6.2.0.tgz, Flask_Cors-3.0.10-py2.py3-none-any.whl, bcprov-jdk18on-1.72.jar which are vulnerable to CVE-2024-28863, CVE-2024-1681 and CVE-2024-30171	28 Jan 202522:08	–	ibm
IBM Security Bulletins	Security Bulletin: Log Injection Vulnerability in orydolphin/flask-cors (Debug Logging) affects watsonx.data	8 Apr 202608:45	–	ibm
BDU FSTEC	Flask Framework Output Modification	24 Sep 202500:00	–	bdu_fstec
Chainguard	CVE-2024-1681 vulnerabilities	19 Apr 202420:15	–	cgr
CNNVD	Flask-CORS 安全漏洞	19 Apr 202400:00	–	cnnvd

Vulners

Node

Source	Link
lists	www.lists.debian.org/debian-lts-announce/2025/05/msg00049.html
huntr	www.huntr.com/bounties/25a7a0ba-9fa2-4777-acb6-03e5539bb644
github	www.github.com/advisories/GHSA-84pr-m4jr-85g5

21 May 2026 14:54Current

6.4Medium risk

Vulners AI Score6.4

CVSS 3.15.3

CVSS 35.3

EPSS0.00579

SSVC