p PatchFirst

CVE-2024-6839

CVE-2024-6839 · Improper Regex Path Matching in corydolphin/flask-cors

This page contains facts from public vulnerability sources. Check the original advisory before updating.

corydolphin/flask-cors version 4.0.1 contains an improper regex path matching vulnerability. The plugin prioritizes longer regex patterns over more specific ones when matching paths, which can lead to less restrictive CORS policies being applied to sensitive endpoints. This mismatch in regex pattern priority allows unauthorized cross-origin access to sensitive data or functionality, potentially exposing confidential information and increasing the risk of unauthorized actions by malicious actors.

CVSS 4.3 · Medium · EPSS 0.7% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • corydolphin/flask-cors

    Versions
    • ≥ unspecified, ≤ latest: Affected (custom)

    No fix published

  • python-flask-cors Debian:12

    Versions
    • 3.0.10-2
    Affected ranges
    • ECOSYSTEM: < 3.0.10-2+deb12u1

    Update to 3.0.10-2+deb12u1

  • python-flask-cors Debian:13

    Affected ranges
    • ECOSYSTEM: < 6.0.1-1

    Update to 6.0.1-1

  • python-flask-cors Debian:14

    Affected ranges
    • ECOSYSTEM: < 6.0.1-1

    Update to 6.0.1-1

  • flask-cors PyPI

    Versions
    • 0.0.0.dev3
    • 0.0.0.dev4
    • 1.0
    • 1.1
    • 1.1.1
    • 1.1.2
    • 1.1.3
    • 1.10.0
    • 1.10.1
    • 1.10.2
    • 1.10.3
    • 1.2.0
    • 1.2.1
    • 1.3.0
    • 1.3.1
    • 1.4.0
    • 1.5.0
    • 1.6.0
    • 1.6.1
    • 1.7.0
    • 1.7.1
    • 1.7.2
    • 1.7.3
    • 1.7.4
    • 1.8.0
    • 1.8.1
    • 1.9.0
    • 2.0.0
    • 2.0.0rc1
    • 2.0.1
    • 2.1.0
    • 2.1.1
    • 2.1.2
    • 2.1.3
    • 3.0.0
    • 3.0.1
    • 3.0.10
    • 3.0.2
    • 3.0.3
    • 3.0.4
    • 3.0.6
    • 3.0.7
    • 3.0.8
    • 3.0.9
    • 4.0.0
    • 4.0.0a0
    • 4.0.1
    • 4.0.2
    • 5.0.0
    • 5.0.1
    Affected ranges
    • ECOSYSTEM: < 6.0.0

    Update to 6.0.0

  • python-flask-cors Ubuntu:Pro:20.04:LTS

    Versions
    • 3.0.8-2
    • 3.0.8-2ubuntu0.1
    Affected ranges
    • ECOSYSTEM: < 3.0.8-2ubuntu0.1+esm1

    Update to 3.0.8-2ubuntu0.1+esm1

  • python-flask-cors Ubuntu:22.04:LTS

    Versions
    • 3.0.9-2
    Affected ranges
    • ECOSYSTEM: < 3.0.9-2ubuntu0.1

    Update to 3.0.9-2ubuntu0.1

  • python-flask-cors Ubuntu:Pro:24.04:LTS

    Versions
    • 4.0.0-1
    Affected ranges
    • ECOSYSTEM: < 4.0.0-1ubuntu0.1~esm1

    Update to 4.0.0-1ubuntu0.1~esm1

Original sources

Check your server →