Flask-CORS allows for inconsistent CORS matching

TRUNG BÌNH 5.3CVE-2024-6844 · GHSA-8vgw-p6qm-5gr7 · PYSEC-2026-1385 · Công bố 20/03/2025 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2024-6844 là lỗ hổng mức TRUNG BÌNH (CVSS 5.3) ảnh hưởng flask-cors, flask-cors (flask-cors project).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.32%, cao hơn 24.9% các lỗ hổng khác.
Cách xử lý: cập nhật lên 6.0.0 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
flask-cors PyPI	`< 6.0.0`	`6.0.0`
flask-cors flask-cors_project	`= 4.0.1`	Chưa có bản vá

Mô tả

A vulnerability in corydolphin/flask-cors version 5.0.1 allows for inconsistent CORS matching due to the handling of the '+' character in URL paths. The request.path is passed through the unquote_plus function, which converts the '+' character to a space ' '. This behavior leads to incorrect path normalization, causing potential mismatches in CORS configuration. As a result, endpoints may not be matched correctly to their CORS settings, leading to unexpected CORS policy application. This can cause unauthorized cross-origin access or block valid requests, creating security vulnerabilities and usability issues.

Mô tả của NVD

A vulnerability in corydolphin/flask-cors version 4.0.1 allows for inconsistent CORS matching due to the handling of the '+' character in URL paths. The request.path is passed through the unquote_plus function, which converts the '+' character to a space ' '. This behavior leads to incorrect path normalization, causing potential mismatches in CORS configuration. As a result, endpoints may not be matched correctly to their CORS settings, leading to unexpected CORS policy application. This can cause unauthorized cross-origin access or block valid requests, creating security vulnerabilities and usability issues.