p PatchFirst

CVE-2024-6221

CVE-2024-6221 · Improper Access Control in corydolphin/flask-cors

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A vulnerability in corydolphin/flask-cors version 4.0.1 allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default. This behavior can expose private network resources to unauthorized external access, leading to significant security risks such as data breaches, unauthorized access to sensitive information, and potential network intrusions.

CVSS 6.5 · Medium · EPSS 0.7% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • corydolphin/flask-cors

    Versions
    • ≥ unspecified, < 5.0.0: Affected (custom)

    Update to 5.0.0

  • python-flask-cors Debian:13

    Affected ranges
    • ECOSYSTEM: < 5.0.0-1

    Update to 5.0.0-1

  • python-flask-cors Debian:14

    Affected ranges
    • ECOSYSTEM: < 5.0.0-1

    Update to 5.0.0-1

  • flask-cors PyPI

    Versions
    • 0.0.0.dev3
    • 0.0.0.dev4
    • 1.0
    • 1.1
    • 1.1.1
    • 1.1.2
    • 1.1.3
    • 1.10.0
    • 1.10.1
    • 1.10.2
    • 1.10.3
    • 1.2.0
    • 1.2.1
    • 1.3.0
    • 1.3.1
    • 1.4.0
    • 1.5.0
    • 1.6.0
    • 1.6.1
    • 1.7.0
    • 1.7.1
    • 1.7.2
    • 1.7.3
    • 1.7.4
    • 1.8.0
    • 1.8.1
    • 1.9.0
    • 2.0.0
    • 2.0.0rc1
    • 2.0.1
    • 2.1.0
    • 2.1.1
    • 2.1.2
    • 2.1.3
    • 3.0.0
    • 3.0.1
    • 3.0.10
    • 3.0.2
    • 3.0.3
    • 3.0.4
    • 3.0.6
    • 3.0.7
    • 3.0.8
    • 3.0.9
    • 4.0.0
    • 4.0.0a0
    • 4.0.1
    Affected ranges
    • ECOSYSTEM: < 4.0.2

    Update to 4.0.2

  • python-flask-cors Ubuntu:Pro:20.04:LTS

    Versions
    • 3.0.8-2
    • 3.0.8-2ubuntu0.1
    Affected ranges
    • ECOSYSTEM: < 3.0.8-2ubuntu0.1+esm1

    Update to 3.0.8-2ubuntu0.1+esm1

  • python-flask-cors Ubuntu:22.04:LTS

    Versions
    • 3.0.9-2
    Affected ranges
    • ECOSYSTEM: < 3.0.9-2ubuntu0.1

    Update to 3.0.9-2ubuntu0.1

  • python-flask-cors Ubuntu:Pro:24.04:LTS

    Versions
    • 4.0.0-1
    Affected ranges
    • ECOSYSTEM: < 4.0.0-1ubuntu0.1~esm1

    Update to 4.0.0-1ubuntu0.1~esm1

Original sources

Check your server →