CVE-2024-6844
published 2025-03-20CVE-2024-6844: A vulnerability in corydolphin/flask-cors version 4.0.1 allows for inconsistent CORS matching due to the handling of the '+' character in URL paths. The…
PriorityP427medium5.3CVSS 3.0
AVNACLPRNUINSUCLINAN
EPSS
0.28%
20.3th percentile
A vulnerability in corydolphin/flask-cors version 4.0.1 allows for inconsistent CORS matching due to the handling of the '+' character in URL paths. The request.path is passed through the unquote_plus function, which converts the '+' character to a space ' '. This behavior leads to incorrect path normalization, causing potential mismatches in CORS configuration. As a result, endpoints may not be matched correctly to their CORS settings, leading to unexpected CORS policy application. This can cause unauthorized cross-origin access or block valid requests, creating security vulnerabilities and usability issues.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| corydolphin | corydolphin_flask-cors | unspecified – latest | — |
| debian | python-flask-cors | < python-flask-cors 3.0.10-2+deb12u1 (bookworm) | python-flask-cors 3.0.10-2+deb12u1 (bookworm) |
| flask-cors_project | flask-cors | — | — |
| flask-cors_project | flask-cors | >= 0 < 6.0.0 | 6.0.0 |
CVSS provenance
nvdv3.05.3MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
osv5.3MEDIUM
vendor_debian5.3MEDIUM
vendor_ubuntu5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
python-flask-cors vulnerabilities
osv·2025-07-02·CVSS 5.3
CVE-2024-6839 [MEDIUM] python-flask-cors vulnerabilities
python-flask-cors vulnerabilities
It was discovered that Flask-CORS did not correctly handle certain regular
expressions. A remote attacker could possibly use this issue to leak
sensitive information or bypass authentication mechanisms. (CVE-2024-6839)
It was discovered that Flask-CORS allowed certain CORS headers to be
enabled by default. A remote attacker could possibly use this issue to leak
sensitive information. This issue only affected Ubuntu 20.04 LTS, Ubuntu
22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 24.10. (CVE-2024-6221) It was
discovered that Flask-CORS did not correctly handle case sensitivity when
matching paths. A remote attacker could possibly use this issue to leak
sensitive information. (CVE-2024-6866) It was discovered that Flask-CORS
did not correctly handle certain charact
OSV
Flask-CORS allows for inconsistent CORS matching
osv·2025-03-20
CVE-2024-6844 [MEDIUM] Flask-CORS allows for inconsistent CORS matching
Flask-CORS allows for inconsistent CORS matching
A vulnerability in corydolphin/flask-cors version 5.0.1 allows for inconsistent CORS matching due to the handling of the '+' character in URL paths. The request.path is passed through the unquote_plus function, which converts the '+' character to a space ' '. This behavior leads to incorrect path normalization, causing potential mismatches in CORS configuration. As a result, endpoints may not be matched correctly to their CORS settings, leading to unexpected CORS policy application. This can cause unauthorized cross-origin access or block valid requests, creating security vulnerabilities and usability issues.
OSV
CVE-2024-6844: A vulnerability in corydolphin/flask-cors version 4
osv·2025-03-20·CVSS 5.3
CVE-2024-6844 [MEDIUM] CVE-2024-6844: A vulnerability in corydolphin/flask-cors version 4
A vulnerability in corydolphin/flask-cors version 4.0.1 allows for inconsistent CORS matching due to the handling of the '+' character in URL paths. The request.path is passed through the unquote_plus function, which converts the '+' character to a space ' '. This behavior leads to incorrect path normalization, causing potential mismatches in CORS configuration. As a result, endpoints may not be matched correctly to their CORS settings, leading to unexpected CORS policy application. This can cause unauthorized cross-origin access or block valid requests, creating security vulnerabilities and usability issues.
GHSA
Flask-CORS allows for inconsistent CORS matching
ghsa·2025-03-20
CVE-2024-6844 [MEDIUM] CWE-346 Flask-CORS allows for inconsistent CORS matching
Flask-CORS allows for inconsistent CORS matching
A vulnerability in corydolphin/flask-cors version 5.0.1 allows for inconsistent CORS matching due to the handling of the '+' character in URL paths. The request.path is passed through the unquote_plus function, which converts the '+' character to a space ' '. This behavior leads to incorrect path normalization, causing potential mismatches in CORS configuration. As a result, endpoints may not be matched correctly to their CORS settings, leading to unexpected CORS policy application. This can cause unauthorized cross-origin access or block valid requests, creating security vulnerabilities and usability issues.
Ubuntu
Flask-CORS vulnerabilities
vendor_ubuntu·2025-07-02·CVSS 5.3
CVE-2024-6839 [MEDIUM] Flask-CORS vulnerabilities
Title: Flask-CORS vulnerabilities
Summary: Several security issues were fixed in Flask-CORS.
It was discovered that Flask-CORS did not correctly handle certain regular
expressions. A remote attacker could possibly use this issue to leak
sensitive information or bypass authentication mechanisms. (CVE-2024-6839)
It was discovered that Flask-CORS allowed certain CORS headers to be
enabled by default. A remote attacker could possibly use this issue to leak
sensitive information. This issue only affected Ubuntu 20.04 LTS, Ubuntu
22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 24.10. (CVE-2024-6221) It was
discovered that Flask-CORS did not correctly handle case sensitivity when
matching paths. A remote attacker could possibly use this issue to leak
sensitive information. (CVE-2024-6866) It was discove
Debian
CVE-2024-6844: python-flask-cors - A vulnerability in corydolphin/flask-cors version 4.0.1 allows for inconsistent ...
vendor_debian·2024·CVSS 5.3
CVE-2024-6844 [MEDIUM] CVE-2024-6844: python-flask-cors - A vulnerability in corydolphin/flask-cors version 4.0.1 allows for inconsistent ...
A vulnerability in corydolphin/flask-cors version 4.0.1 allows for inconsistent CORS matching due to the handling of the '+' character in URL paths. The request.path is passed through the unquote_plus function, which converts the '+' character to a space ' '. This behavior leads to incorrect path normalization, causing potential mismatches in CORS configuration. As a result, endpoints may not be matched correctly to their CORS settings, leading to unexpected CORS policy application. This can cause unauthorized cross-origin access or block valid requests, creating security vulnerabilities and usability issues.
Scope: local
bookworm: resolved (fixed in 3.0.10-2+deb12u1)
bullseye: resolved (fixed in 3.0.9-2+deb11u1)
forky: resolved (fixed in 6.0.0-1)
sid: resolved (fixed in 6.0.0-1)
trixie: r
No detection rules found.
No public exploits indexed.
2025-03-20
Published