flask-cors
PyPI5 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting flask-corspage 1 of 1
- CVE-2020-25032HIGHCVSS 7.5EG 7.5✓ Fixed in 3.0.92020-08-31
vulnerable: 1.0 ... 0.0.0.dev4 (42 versions)
An issue was discovered in Flask-CORS (aka CORS Middleware for Flask) before 3.0.9. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format.
- CVE-2024-1681MEDIUMCVSS 5.3EG 5.32024-04-19
vulnerable: 0.0.0.dev3 ... 4.0.0a0 (46 versions)
corydolphin/flask-cors is vulnerable to log injection when the log level is set to debug. An attacker can inject fake log entries into the log file by sending a specially crafted GET request containing a CRLF sequence in the request path. …
- CVE-2024-6221HIGHCVSS 7.5EG 7.5✓ Fixed in 4.0.22024-08-18
vulnerable: 1.0 ... 0.0.0.dev4 (47 versions)
A vulnerability in corydolphin/flask-cors version 4.0.1 allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default. This behavior can expose private network resources to unauthorized external access, leading…
- CVE-2024-6844MEDIUMCVSS 5.3EG 5.3✓ Fixed in 6.0.02025-03-20
vulnerable: 0.0.0.dev3 ... 5.0.1 (50 versions)
A vulnerability in corydolphin/flask-cors version 4.0.1 allows for inconsistent CORS matching due to the handling of the '+' character in URL paths. The request.path is passed through the unquote_plus function, which converts the '+' chara…
- CVE-2024-6866HIGHCVSS 7.5EG 7.5✓ Fixed in 6.0.02025-03-20
vulnerable: 0.0.0.dev3 ... 5.0.1 (50 versions)
corydolphin/flask-cors version 4.01 contains a vulnerability where the request path matching is case-insensitive due to the use of the `try_match` function, which is originally intended for matching hosts. This results in a mismatch becaus…
Check whether flask-cors is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for flask-cors CVEs against the assets you own.
Start Free Scan →