A vulnerability in corydolphin/flask-cors version 4.0.1 allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default. This behavior can expose private network resources to unauthorized external access, leading to significant security risks such as data breaches, unauthorized access to sensitive information, and potential network intrusions.
References
| Link | Resource |
|---|---|
| https://github.com/corydolphin/flask-cors/commit/03aa3f8e2256437f7bad96422a747b98ab5e31bf | |
| https://huntr.com/bounties/a42935fc-6f57-4818-bca4-3d528235df4d | Exploit Third Party Advisory |
Configurations
History
07 Apr 2025, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | A vulnerability in corydolphin/flask-cors version 4.0.1 allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default. This behavior can expose private network resources to unauthorized external access, leading to significant security risks such as data breaches, unauthorized access to sensitive information, and potential network intrusions. | |
| References |
|
20 Aug 2024, 19:37
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Corydolphin flask-cors
Corydolphin |
|
| CWE | NVD-CWE-Other | |
| References | () https://huntr.com/bounties/a42935fc-6f57-4818-bca4-3d528235df4d - Exploit, Third Party Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| CPE | cpe:2.3:a:corydolphin:flask-cors:4.0.1:*:*:*:*:*:*:* |
18 Aug 2024, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-08-18 19:15
Updated : 2025-04-07 15:15
NVD link : CVE-2024-6221
Mitre link : CVE-2024-6221
JSON object : View
Products Affected
corydolphin
- flask-cors
CWE