CVE-2024-1681: flask-cors vulnerable to log injection… – CVSS 5.3 · Watchpost

← 脆弱性一覧

flask-cors vulnerable to log injection when the log level is set to debug

中 5.3CVE-2024-1681 · GHSA-84pr-m4jr-85g5 · PYSEC-2024-271 · 19/04/2024 公開 · 17/06/2026 更新

要点

CVE-2024-1681 は flask-cors, flask-cors (corydolphin) に影響する深刻度「中」 (CVSS 5.3) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.58%（全脆弱性の 47.6% より高い）。
対処：4.0.1 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
flask-cors PyPI	`≤ 4.0.0< 4.0.1`	`4.0.1`
flask-cors corydolphin	`= 4.0.0`	修正版なし

概要

corydolphin/flask-cors is vulnerable to log injection when the log level is set to debug. An attacker can inject fake log entries into the log file by sending a specially crafted GET request containing a CRLF sequence in the request path. This vulnerability allows attackers to corrupt log files, potentially covering tracks of other attacks, confusing log post-processing tools, and forging log entries. The issue is due to improper output neutralization for logs.

NVD の説明

corydolphin/flask-cors is vulnerable to log injection when the log level is set to debug. An attacker can inject fake log entries into the log file by sending a specially crafted GET request containing a CRLF sequence in the request path. This vulnerability allows attackers to corrupt log files, potentially covering tracks of other attacks, confusing log post-processing tools, and forging log entries. The issue is due to improper output neutralization for logs.

参考情報

nvd.nist.gov/vuln/detail/CVE-2024-1681 · ADVISORY
corydolphin/flask-cors · PACKAGE
corydolphin/flask-cors · WEB
pypa/advisory-database · WEB
huntr.com/bounties/25a7a0ba-9fa2-4777-acb6-03e5539bb644 · WEB
lists.debian.org/debian-lts-announce/2025/05/msg00049.html · WEB
GitHub Advisory GHSA-84pr-m4jr-85g5 · ADVISORY

flask-cors のその他の脆弱性

すべて見る →

これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。

無料でサイトをスキャン