CVE-2024-1681
published 2024-04-19CVE-2024-1681: corydolphin/flask-cors is vulnerable to log injection when the log level is set to debug. An attacker can inject fake log entries into the log file by sending…
PriorityP429medium5.3CVSS 3.1
AVNACLPRNUINSUCNILAN
EPSS
0.57%
43.9th percentile
corydolphin/flask-cors is vulnerable to log injection when the log level is set to debug. An attacker can inject fake log entries into the log file by sending a specially crafted GET request containing a CRLF sequence in the request path. This vulnerability allows attackers to corrupt log files, potentially covering tracks of other attacks, confusing log post-processing tools, and forging log entries. The issue is due to improper output neutralization for logs.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| corydolphin | corydolphin_flask-cors | unspecified – latest | — |
| corydolphin | flask-cors | — | — |
| debian | python-flask-cors | < python-flask-cors 3.0.10-2+deb12u1 (bookworm) | python-flask-cors 3.0.10-2+deb12u1 (bookworm) |
| flask-cors_project | flask-cors | >= 0 < 4.0.1 | 4.0.1 |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
nvdv3.05.3MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
ghsa5.3MEDIUM
osv5.3MEDIUM
vendor_debian5.3MEDIUM
vendor_ubuntu5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
python-flask-cors vulnerabilities
osv·2025-07-02·CVSS 5.3
CVE-2024-6839 [MEDIUM] python-flask-cors vulnerabilities
python-flask-cors vulnerabilities
It was discovered that Flask-CORS did not correctly handle certain regular
expressions. A remote attacker could possibly use this issue to leak
sensitive information or bypass authentication mechanisms. (CVE-2024-6839)
It was discovered that Flask-CORS allowed certain CORS headers to be
enabled by default. A remote attacker could possibly use this issue to leak
sensitive information. This issue only affected Ubuntu 20.04 LTS, Ubuntu
22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 24.10. (CVE-2024-6221) It was
discovered that Flask-CORS did not correctly handle case sensitivity when
matching paths. A remote attacker could possibly use this issue to leak
sensitive information. (CVE-2024-6866) It was discovered that Flask-CORS
did not correctly handle certain charact
GHSA
Taipy 3.1.1 affected by CVEs on flask-core and pymongo
ghsa·2024-08-27·CVSS 5.3
CVE-2024-1681 [MEDIUM] Taipy 3.1.1 affected by CVEs on flask-core and pymongo
Taipy 3.1.1 affected by CVEs on flask-core and pymongo
### Summary
Indirect CVEs affect Taipy 3.1.1
### Details
Taipy 3.1.1 is affected by two existing CVEs:
CVE-2024-1681 affects flask-core =3.1.2
and on major releases: >=4.0.0
### Impact
pre-commit breaks when using dependency Taipy 3.1.1
OSV
Taipy 3.1.1 affected by CVEs on flask-core and pymongo
osv·2024-08-27·CVSS 5.3
CVE-2024-1681 [MEDIUM] Taipy 3.1.1 affected by CVEs on flask-core and pymongo
Taipy 3.1.1 affected by CVEs on flask-core and pymongo
### Summary
Indirect CVEs affect Taipy 3.1.1
### Details
Taipy 3.1.1 is affected by two existing CVEs:
CVE-2024-1681 affects flask-core =3.1.2
and on major releases: >=4.0.0
### Impact
pre-commit breaks when using dependency Taipy 3.1.1
OSV
CVE-2024-1681: corydolphin/flask-cors is vulnerable to log injection when the log level is set to debug
osv·2024-04-19·CVSS 5.3
CVE-2024-1681 [MEDIUM] CVE-2024-1681: corydolphin/flask-cors is vulnerable to log injection when the log level is set to debug
corydolphin/flask-cors is vulnerable to log injection when the log level is set to debug. An attacker can inject fake log entries into the log file by sending a specially crafted GET request containing a CRLF sequence in the request path. This vulnerability allows attackers to corrupt log files, potentially covering tracks of other attacks, confusing log post-processing tools, and forging log entries. The issue is due to improper output neutralization for logs.
GHSA
flask-cors vulnerable to log injection when the log level is set to debug
ghsa·2024-04-19
CVE-2024-1681 [MEDIUM] CWE-117 flask-cors vulnerable to log injection when the log level is set to debug
flask-cors vulnerable to log injection when the log level is set to debug
corydolphin/flask-cors is vulnerable to log injection when the log level is set to debug. An attacker can inject fake log entries into the log file by sending a specially crafted GET request containing a CRLF sequence in the request path. This vulnerability allows attackers to corrupt log files, potentially covering tracks of other attacks, confusing log post-processing tools, and forging log entries. The issue is due to improper output neutralization for logs.
OSV
flask-cors vulnerable to log injection when the log level is set to debug
osv·2024-04-19
CVE-2024-1681 [MEDIUM] flask-cors vulnerable to log injection when the log level is set to debug
flask-cors vulnerable to log injection when the log level is set to debug
corydolphin/flask-cors is vulnerable to log injection when the log level is set to debug. An attacker can inject fake log entries into the log file by sending a specially crafted GET request containing a CRLF sequence in the request path. This vulnerability allows attackers to corrupt log files, potentially covering tracks of other attacks, confusing log post-processing tools, and forging log entries. The issue is due to improper output neutralization for logs.
Ubuntu
Flask-CORS vulnerabilities
vendor_ubuntu·2025-07-02·CVSS 5.3
CVE-2024-6839 [MEDIUM] Flask-CORS vulnerabilities
Title: Flask-CORS vulnerabilities
Summary: Several security issues were fixed in Flask-CORS.
It was discovered that Flask-CORS did not correctly handle certain regular
expressions. A remote attacker could possibly use this issue to leak
sensitive information or bypass authentication mechanisms. (CVE-2024-6839)
It was discovered that Flask-CORS allowed certain CORS headers to be
enabled by default. A remote attacker could possibly use this issue to leak
sensitive information. This issue only affected Ubuntu 20.04 LTS, Ubuntu
22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 24.10. (CVE-2024-6221) It was
discovered that Flask-CORS did not correctly handle case sensitivity when
matching paths. A remote attacker could possibly use this issue to leak
sensitive information. (CVE-2024-6866) It was discove
Debian
CVE-2024-1681: python-flask-cors - corydolphin/flask-cors is vulnerable to log injection when the log level is set ...
vendor_debian·2024·CVSS 5.3
CVE-2024-1681 [MEDIUM] CVE-2024-1681: python-flask-cors - corydolphin/flask-cors is vulnerable to log injection when the log level is set ...
corydolphin/flask-cors is vulnerable to log injection when the log level is set to debug. An attacker can inject fake log entries into the log file by sending a specially crafted GET request containing a CRLF sequence in the request path. This vulnerability allows attackers to corrupt log files, potentially covering tracks of other attacks, confusing log post-processing tools, and forging log entries. The issue is due to improper output neutralization for logs.
Scope: local
bookworm: resolved (fixed in 3.0.10-2+deb12u1)
bullseye: resolved (fixed in 3.0.9-2+deb11u1)
forky: resolved (fixed in 4.0.1-1)
sid: resolved (fixed in 4.0.1-1)
trixie: resolved (fixed in 4.0.1-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-04-19
Published