High severity · published Aug 18, 2024
CVE-2024-6221
A vulnerability in corydolphin/flask-cors version 4.0.1 allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default
7.5
CVSS
0.7%
EPSS
No
On KEV
Description
A vulnerability in corydolphin/flask-cors version 4.0.1 allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default. This behavior can expose private network resources to unauthorized external access, leading to significant security risks such as data breaches, unauthorized access to sensitive information, and potential network intrusions.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FL
Flask-cors · Corydolphin
4.0.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-6221
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-6221
github.com
https://github.com/corydolphin/flask-cors/commit/03aa3f8e2256437f7bad96422a747b98ab5e31bf
Exploit
https://huntr.com/bounties/a42935fc-6f57-4818-bca4-3d528235df4d
More from Flask-cors
5.3
CVE-2024-1681
corydolphin/flask-cors is vulnerable to log injection when the log level is set to debug