PyPI/flask-cors CVE-2024-6221: high 7.5, EPSS 0.72%
A vulnerability in corydolphin/flask-cors up to version 4.0.1 allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default, without any configuration option. This behavio
Action: Upgrade flask-cors to 4.0.2 or later.
pip install flask-cors==4.0.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 4.0.2 | - |
Fixed versions
| 4.0.2 |
Sources
- osv: PYSEC-2024-71
- https://huntr.com/bounties/a42935fc-6f57-4818-bca4-3d528235df4d
- https://github.com/corydolphin/flask-cors/commit/7ae310c56ac30e0b94fb42129aa377bf633256ec
- https://github.com/advisories/GHSA-hxwh-jpp2-84pm
CVE-2024-6221 · published · modified · JSON