PyPI/flask-cors CVE-2024-6221: high 7.5, EPSS 0.72%
Flask-CORS allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default
Action: Upgrade flask-cors to 4.0.2 or later.
pip install flask-cors==4.0.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 4.0.2 | - |
Fixed versions
| 4.0.2 |
Sources
- osv: GHSA-hxwh-jpp2-84pm
- https://nvd.nist.gov/vuln/detail/CVE-2024-6221
- https://github.com/corydolphin/flask-cors/issues/362
- https://github.com/corydolphin/flask-cors/pull/363
- https://github.com/corydolphin/flask-cors/pull/368
- https://github.com/corydolphin/flask-cors/commit/03aa3f8e2256437f7bad96422a747b98ab5e31bf
- https://github.com/corydolphin/flask-cors/commit/7ae310c56ac30e0b94fb42129aa377bf633256ec
- https://github.com/corydolphin/flask-cors/commit/c8514760cf03fcce16d77f6db7007aad429c4548
- https://github.com/corydolphin/flask-cors
- https://github.com/corydolphin/flask-cors/releases
- https://github.com/pypa/advisory-database/tree/main/vulns/flask-cors/PYSEC-2024-260.yaml
- https://github.com/pypa/advisory-database/tree/main/vulns/flask-cors/PYSEC-2024-71.yaml
- https://huntr.com/bounties/a42935fc-6f57-4818-bca4-3d528235df4d
CVE-2024-6221 · published · modified · JSON