Flask-Cors Directory Traversal vulnerability

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2020-25032 · ADVISORY
• corydolphin/flask-cors commit 67c4b2c · WEB
• GitHub Advisory GHSA-xc3p-ff3m-f46v · ADVISORY
• corydolphin/flask-cors · PACKAGE
• corydolphin/flask-cors release 3.0.9 · WEB
• pypa/advisory-database · WEB
• debian.org/security/2020/dsa-4775 · WEB
• lists.opensuse.org/opensuse-security-announce/2020-09/msg00028.html · WEB
• lists.opensuse.org/opensuse-security-announce/2020-09/msg00032.html · WEB
• lists.opensuse.org/opensuse-security-announce/2020-09/msg00039.html · WEB
• lists.opensuse.org/opensuse-security-announce/2020-09/msg00048.html

flask-cors のその他の脆弱性

• CVE-2024-6866高 7.5corydolphin/flask-cors version 4.01 contains a vulnerability where the request path matching is case-insensitive due to the use of the `try_…
• CVE-2024-6844中 5.3A vulnerability in corydolphin/flask-cors version 4.0.1 allows for inconsistent CORS matching due to the handling of the '+' character in UR…
• CVE-2024-6839中 5.3corydolphin/flask-cors version 4.0.1 contains an improper regex path matching vulnerability. The plugin prioritizes longer regex patterns ov…
• CVE-2024-6221高 7.5A vulnerability in corydolphin/flask-cors version 4.0.1 allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by d…
• CVE-2024-1681中 5.3corydolphin/flask-cors is vulnerable to log injection when the log level is set to debug. An attacker can inject fake log entries into the l…