High severity · published Aug 18, 2024
CVE-2024-6221
Improper Access Control in corydolphin/flask-cors
7.5
CVSS
0.7%
EPSS
No
On KEV
Description
A vulnerability in corydolphin/flask-cors version 4.0.1 allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default. This behavior can expose private network resources to unauthorized external access, leading to significant security risks such as data breaches, unauthorized access to sensitive information, and potential network intrusions.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
corydolphin/flask-cors · corydolphin
before 5.0.0 · source: vendor
FL
Flask-cors · Corydolphin
4.0.1 · source: NVD, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-6221
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-6221
github.com
https://github.com/corydolphin/flask-cors/commit/03aa3f8e2256437f7bad96422a747b98ab5e31bf
Exploit
https://huntr.com/bounties/a42935fc-6f57-4818-bca4-3d528235df4d
More from corydolphin/flask-cors
7.5
CVE-2024-6866
Case-Insensitive Path Matching in corydolphin/flask-cors
5.3
CVE-2024-6844
Inconsistent CORS Matching Due to Handling of '+' in URL Path in corydolphin/flask-cors
5.3
CVE-2024-6839
Improper Regex Path Matching in corydolphin/flask-cors
5.3
CVE-2024-1681
Log Injection Vulnerability in corydolphin/flask-cors