CVE-2020-25032 — Path Traversal in Project Flask-cors

CWE-22 — Path Traversal10 documents8 sources
Severity
7.5HIGHNVD
EPSS
0.9%
top 24.34%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Flask-cors Project Flask-corsDebian LinuxOpensuse Backports SLE+1 more
Timeline
PublishedAug 31
Latest updateApr 13

Description

An issue was discovered in Flask-CORS (aka CORS Middleware for Flask) before 3.0.9. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages4 packages

▶NVDopensuse/leap15.1, 15.2+1

Also affects: Debian Linux 10.0

🔴Vulnerability Details

4
OSV
Flask-Cors Directory Traversal vulnerability↗2021-05-06
▶
GHSA
Flask-Cors Directory Traversal vulnerability↗2021-05-06
▶
OSV
CVE-2020-25032: An issue was discovered in Flask-CORS (aka CORS Middleware for Flask) before 3↗2020-08-31
▶
CVEList
CVE-2020-25032: An issue was discovered in Flask-CORS (aka CORS Middleware for Flask) before 3↗2020-08-31
▶

📋Vendor Advisories

3
Ubuntu
Flask-CORS vulnerability↗2023-04-13
▶
Red Hat
python-flask-cors: allows ../ directory traversal to access private resources↗2020-08-31
▶
Debian
CVE-2020-25032: python-flask-cors - An issue was discovered in Flask-CORS (aka CORS Middleware for Flask) before 3.0...↗2020
▶

💬Community

2
Bugzilla
CVE-2020-25032 python-flask-cors: allows ../ directory traversal to access private resources [fedora-all]↗2020-09-08
▶
Bugzilla
CVE-2020-25032 python-flask-cors: allows ../ directory traversal to access private resources↗2020-09-08
▶
CVE-2020-25032 — Path Traversal in Project Flask-cors | cvebase