CVE-2024-6839
published 2025-03-20CVE-2024-6839: corydolphin/flask-cors version 4.0.1 contains an improper regex path matching vulnerability. The plugin prioritizes longer regex patterns over more specific…
PriorityP428medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
0.65%
47.5th percentile
corydolphin/flask-cors version 4.0.1 contains an improper regex path matching vulnerability. The plugin prioritizes longer regex patterns over more specific ones when matching paths, which can lead to less restrictive CORS policies being applied to sensitive endpoints. This mismatch in regex pattern priority allows unauthorized cross-origin access to sensitive data or functionality, potentially exposing confidential information and increasing the risk of unauthorized actions by malicious actors.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| corydolphin | corydolphin_flask-cors | unspecified – latest | — |
| debian | python-flask-cors | < python-flask-cors 3.0.10-2+deb12u1 (bookworm) | python-flask-cors 3.0.10-2+deb12u1 (bookworm) |
| flask-cors_project | flask-cors | — | — |
| flask-cors_project | flask-cors | >= 0 < 6.0.0 | 6.0.0 |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
nvdv3.04.3MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
osv5.3MEDIUM
vendor_debian5.3MEDIUM
vendor_ubuntu5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
python-flask-cors vulnerabilities
osv·2025-07-02·CVSS 5.3
CVE-2024-6839 [MEDIUM] python-flask-cors vulnerabilities
python-flask-cors vulnerabilities
It was discovered that Flask-CORS did not correctly handle certain regular
expressions. A remote attacker could possibly use this issue to leak
sensitive information or bypass authentication mechanisms. (CVE-2024-6839)
It was discovered that Flask-CORS allowed certain CORS headers to be
enabled by default. A remote attacker could possibly use this issue to leak
sensitive information. This issue only affected Ubuntu 20.04 LTS, Ubuntu
22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 24.10. (CVE-2024-6221) It was
discovered that Flask-CORS did not correctly handle case sensitivity when
matching paths. A remote attacker could possibly use this issue to leak
sensitive information. (CVE-2024-6866) It was discovered that Flask-CORS
did not correctly handle certain charact
GHSA
Flask-CORS improper regex path matching vulnerability
ghsa·2025-03-20
CVE-2024-6839 [MEDIUM] CWE-41 Flask-CORS improper regex path matching vulnerability
Flask-CORS improper regex path matching vulnerability
corydolphin/flask-cors version 5.0.1 contains an improper regex path matching vulnerability. The plugin prioritizes longer regex patterns over more specific ones when matching paths, which can lead to less restrictive CORS policies being applied to sensitive endpoints. This mismatch in regex pattern priority allows unauthorized cross-origin access to sensitive data or functionality, potentially exposing confidential information and increasing the risk of unauthorized actions by malicious actors.
OSV
CVE-2024-6839: corydolphin/flask-cors version 4
osv·2025-03-20·CVSS 5.3
CVE-2024-6839 [MEDIUM] CVE-2024-6839: corydolphin/flask-cors version 4
corydolphin/flask-cors version 4.0.1 contains an improper regex path matching vulnerability. The plugin prioritizes longer regex patterns over more specific ones when matching paths, which can lead to less restrictive CORS policies being applied to sensitive endpoints. This mismatch in regex pattern priority allows unauthorized cross-origin access to sensitive data or functionality, potentially exposing confidential information and increasing the risk of unauthorized actions by malicious actors.
OSV
Flask-CORS improper regex path matching vulnerability
osv·2025-03-20
CVE-2024-6839 [MEDIUM] Flask-CORS improper regex path matching vulnerability
Flask-CORS improper regex path matching vulnerability
corydolphin/flask-cors version 5.0.1 contains an improper regex path matching vulnerability. The plugin prioritizes longer regex patterns over more specific ones when matching paths, which can lead to less restrictive CORS policies being applied to sensitive endpoints. This mismatch in regex pattern priority allows unauthorized cross-origin access to sensitive data or functionality, potentially exposing confidential information and increasing the risk of unauthorized actions by malicious actors.
Ubuntu
Flask-CORS vulnerabilities
vendor_ubuntu·2025-07-02·CVSS 5.3
CVE-2024-6839 [MEDIUM] Flask-CORS vulnerabilities
Title: Flask-CORS vulnerabilities
Summary: Several security issues were fixed in Flask-CORS.
It was discovered that Flask-CORS did not correctly handle certain regular
expressions. A remote attacker could possibly use this issue to leak
sensitive information or bypass authentication mechanisms. (CVE-2024-6839)
It was discovered that Flask-CORS allowed certain CORS headers to be
enabled by default. A remote attacker could possibly use this issue to leak
sensitive information. This issue only affected Ubuntu 20.04 LTS, Ubuntu
22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 24.10. (CVE-2024-6221) It was
discovered that Flask-CORS did not correctly handle case sensitivity when
matching paths. A remote attacker could possibly use this issue to leak
sensitive information. (CVE-2024-6866) It was discove
Debian
CVE-2024-6839: python-flask-cors - corydolphin/flask-cors version 4.0.1 contains an improper regex path matching vu...
vendor_debian·2024·CVSS 5.3
CVE-2024-6839 [MEDIUM] CVE-2024-6839: python-flask-cors - corydolphin/flask-cors version 4.0.1 contains an improper regex path matching vu...
corydolphin/flask-cors version 4.0.1 contains an improper regex path matching vulnerability. The plugin prioritizes longer regex patterns over more specific ones when matching paths, which can lead to less restrictive CORS policies being applied to sensitive endpoints. This mismatch in regex pattern priority allows unauthorized cross-origin access to sensitive data or functionality, potentially exposing confidential information and increasing the risk of unauthorized actions by malicious actors.
Scope: local
bookworm: resolved (fixed in 3.0.10-2+deb12u1)
bullseye: resolved (fixed in 3.0.9-2+deb11u1)
forky: resolved (fixed in 6.0.1-1)
sid: resolved (fixed in 6.0.1-1)
trixie: resolved (fixed in 6.0.1-1)
No detection rules found.
No public exploits indexed.
2025-03-20
Published