{"id":"CVE-2024-1681","aliases":["CLSA-2026-1789716215","DEBIAN-CVE-2024-1681","DLA-4197-1","EUVD-2024-1152","GHSA-84pr-m4jr-85g5","MGASA-2025-0286","OESA-2024-1713","PYSEC-2024-271","ROOT-APP-PYPI-CVE-2024-1681","UBUNTU-CVE-2024-1681","USN-7612-1","openSUSE-SU-2024:14293-1","openSUSE-SU-2026:11990-1"],"status":"published","title":"Log Injection Vulnerability in corydolphin/flask-cors","description":"corydolphin/flask-cors is vulnerable to log injection when the log level is set to debug. An attacker can inject fake log entries into the log file by sending a specially crafted GET request containing a CRLF sequence in the request path. This vulnerability allows attackers to corrupt log files, potentially covering tracks of other attacks, confusing log post-processing tools, and forging log entries. The issue is due to improper output neutralization for logs.","severity":{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00574,"percentile":0.47841,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-117"],"published":"2024-04-19T19:37:27Z","modified":"2026-11-02T12:00:42Z","fixes":[{"ecosystem":"PyPI","package":"flask-cors","fixed_in":["4.0.1"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"python-flask-cors","fixed_in":["3.0.10-2+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"python-flask-cors","fixed_in":["4.0.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-flask-cors","fixed_in":["4.0.1-1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"python-Flask-Cors","fixed_in":["4.0.0-2.oe2403"],"sources":["osv"]},{"ecosystem":"Root:PyPI","package":"rootio-flask-cors","fixed_in":["3.0.10+root.io.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python-flask-cors","fixed_in":["3.0.8-2ubuntu0.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"python-flask-cors","fixed_in":["3.0.9-2ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"python-flask-cors","fixed_in":["4.0.0-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"python-Flask-Cors","fixed_in":["4.0.1-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"flask-cors","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.0.0"},{"fixed":"4.0.1"}]}]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"flask-cors","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.10"},{"fixed":"3.0.10.post1+tuxcare"}]}],"versions":["3.0.10"],"bundled":4},{"source":"osv","ecosystem":"Debian:12","package":"python-flask-cors","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.10-2+deb12u1"}]}],"versions":["3.0.10-2"]},{"source":"osv","ecosystem":"Debian:13","package":"python-flask-cors","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"python-flask-cors","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.1-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"python-flask-cors","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.9-2+deb11u1"}]}],"versions":["3.0.9-2"],"bundled":4},{"source":"osv","ecosystem":"PyPI","package":"flask-cors","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.1"}]}],"versions":["0.0.0.dev3","0.0.0.dev4","1.0","1.1","1.1.1","1.1.2","1.1.3","1.10.0","1.10.1","1.10.2","1.10.3","1.2.0","1.2.1","1.3.0","1.3.1","1.4.0","1.5.0","1.6.0","1.6.1","1.7.0","1.7.1","1.7.2","1.7.3","1.7.4","1.8.0","1.8.1","1.9.0","2.0.0","2.0.0rc1","2.0.1","2.1.0","2.1.1","2.1.2","2.1.3","3.0.0","3.0.1","3.0.10","3.0.2","3.0.3","3.0.4","3.0.6","3.0.7","3.0.8","3.0.9","4.0.0","4.0.0a0"]},{"source":"osv","ecosystem":"Mageia:9","package":"python-flask-cors","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.10-1.1.mga9"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"python-Flask-Cors","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.0-2.oe2403"}]}]},{"source":"osv","ecosystem":"PyPI","package":"flask-cors","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.0.0"}]}],"versions":["0.0.0.dev3","0.0.0.dev4","1.0","1.1","1.1.1","1.1.2","1.1.3","1.10.0","1.10.1","1.10.2","1.10.3","1.2.0","1.2.1","1.3.0","1.3.1","1.4.0","1.5.0","1.6.0","1.6.1","1.7.0","1.7.1","1.7.2","1.7.3","1.7.4","1.8.0","1.8.1","1.9.0","2.0.0","2.0.0rc1","2.0.1","2.1.0","2.1.1","2.1.2","2.1.3","3.0.0","3.0.1","3.0.10","3.0.2","3.0.3","3.0.4","3.0.6","3.0.7","3.0.8","3.0.9","4.0.0","4.0.0a0"]},{"source":"osv","ecosystem":"Root:PyPI","package":"rootio-flask-cors","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.10+root.io.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python-flask-cors","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-2ubuntu0.1+esm1"}]}],"versions":["3.0.8-2","3.0.8-2ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"python-flask-cors","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.9-2ubuntu0.1"}]}],"versions":["3.0.9-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"python-flask-cors","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.0-1ubuntu0.1~esm1"}]}],"versions":["4.0.0-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python-flask-cors","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-2ubuntu0.1+esm1"}]}],"versions":["3.0.8-2","3.0.8-2ubuntu0.1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"python-flask-cors","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.9-2ubuntu0.1"}]}],"versions":["3.0.9-2"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"python-flask-cors","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.0-1ubuntu0.1~esm1"}]}],"versions":["4.0.0-1"],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Flask-Cors","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.1-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Flask-Cors","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.2-1.2"}]}],"bundled":2}],"products":[{"vendor":"corydolphin","product":"corydolphin/flask-cors"},{"vendor":"corydolphin","product":"flask-cors"}],"references":[{"url":"https://huntr.com/bounties/25a7a0ba-9fa2-4777-acb6-03e5539bb644","tags":["x_transferred","Exploit","Third Party Advisory","evidence","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/05/msg00049.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-1681","tags":["advisory"]},{"url":"https://github.com/corydolphin/flask-cors/blob/40acc8092332dfed4bb54d7a4f89a6d479466de7/flask_cors/extension.py#L194","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/flask-cors/PYSEC-2024-271.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-84pr-m4jr-85g5","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-1681","tags":["advisory"]},{"url":"https://github.com/corydolphin/flask-cors","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2025-0286.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=34424","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7612-1","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1713","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-1681","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-1681","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-6221","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-6839","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-6844","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-6866","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-1681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25032","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2024-1681","title":"Log Injection Vulnerability in corydolphin/flask-cors","description":"corydolphin/flask-cors is vulnerable to log injection when the log level is set to debug. An attacker can inject fake log entries into the log file by sending a specially crafted GET request containing a CRLF sequence in the request path. This vulnerability allows attackers to corrupt log files, potentially covering tracks of other attacks, confusing log post-processing tools, and forging log entries. The issue is due to improper output neutralization for logs.","status":"published","published":"2024-04-19T19:37:27.998Z","modified":"2025-11-03T19:29:18.706Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-117"],"updated_at":"2026-11-02T14:34:17.865042Z"}],"euvd":[{"id":"EUVD-2024-1152","description":"corydolphin/flask-cors is vulnerable to log injection when the log level is set to debug. An attacker can inject fake log entries into the log file by sending a specially crafted GET request containing a CRLF sequence in the request path. This vulnerability allows attackers to corrupt log files, potentially covering tracks of other attacks, confusing log post-processing tools, and forging log entries. The issue is due to improper output neutralization for logs.","status":"published","published":"2024-04-19T19:37:27Z","modified":"2025-11-03T19:29:18Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:49:33.639996Z"}],"ghsa":[{"id":"GHSA-84pr-m4jr-85g5","title":"flask-cors vulnerable to log injection when the log level is set to debug","description":"corydolphin/flask-cors is vulnerable to log injection when the log level is set to debug. An attacker can inject fake log entries into the log file by sending a specially crafted GET request containing a CRLF sequence in the request path. This vulnerability allows attackers to corrupt log files, potentially covering tracks of other attacks, confusing log post-processing tools, and forging log entries. The issue is due to improper output neutralization for logs.","status":"published","published":"2024-04-19T21:31:08Z","modified":"2026-06-05T17:54:17Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-117"],"updated_at":"2026-11-02T14:40:17.745826Z"}],"nvd":[{"id":"CVE-2024-1681","description":"corydolphin/flask-cors is vulnerable to log injection when the log level is set to debug. An attacker can inject fake log entries into the log file by sending a specially crafted GET request containing a CRLF sequence in the request path. This vulnerability allows attackers to corrupt log files, potentially covering tracks of other attacks, confusing log post-processing tools, and forging log entries. The issue is due to improper output neutralization for logs.","status":"published","published":"2024-04-19T20:15:09.273Z","modified":"2026-06-17T07:04:46.833Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"},{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-117"],"updated_at":"2026-11-02T14:09:53.50104Z"}],"osv":[{"id":"CVE-2024-1681","description":"corydolphin/flask-cors is vulnerable to log injection when the log level is set to debug. An attacker can inject fake log entries into the log file by sending a specially crafted GET request containing a CRLF sequence in the request path. This vulnerability allows attackers to corrupt log files, potentially covering tracks of other attacks, confusing log post-processing tools, and forging log entries. The issue is due to improper output neutralization for logs.","status":"published","published":"2024-04-19T20:15:09.273Z","modified":"2026-10-05T10:26:48.619143081Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:37.917085Z"},{"id":"DEBIAN-CVE-2024-1681","description":"corydolphin/flask-cors is vulnerable to log injection when the log level is set to debug. An attacker can inject fake log entries into the log file by sending a specially crafted GET request containing a CRLF sequence in the request path. This vulnerability allows attackers to corrupt log files, potentially covering tracks of other attacks, confusing log post-processing tools, and forging log entries. The issue is due to improper output neutralization for logs.","status":"published","published":"2024-04-19T20:15:09.273Z","modified":"2026-11-02T12:00:42.286044009Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:41.849198Z"},{"id":"GHSA-84pr-m4jr-85g5","title":"flask-cors vulnerable to log injection when the log level is set to debug","description":"corydolphin/flask-cors is vulnerable to log injection when the log level is set to debug. An attacker can inject fake log entries into the log file by sending a specially crafted GET request containing a CRLF sequence in the request path. This vulnerability allows attackers to corrupt log files, potentially covering tracks of other attacks, confusing log post-processing tools, and forging log entries. The issue is due to improper output neutralization for logs.","status":"published","published":"2024-04-19T21:31:08Z","modified":"2026-09-10T03:50:12.410188532Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-117"],"updated_at":"2026-11-02T15:46:41.732368Z"},{"id":"OESA-2024-1713","title":"python-Flask-Cors security update","description":"A Flask extension for handling Cross Origin Resource Sharing (CORS), making cross-origin AJAX possible.\r\n\r\nSecurity Fix(es):\r\n\r\ncorydolphin/flask-cors is vulnerable to log injection when the log level is set to debug. An attacker can inject fake log entries into the log file by sending a specially crafted GET request containing a CRLF sequence in the request path. This vulnerability allows attackers to corrupt log files, potentially covering tracks of other attacks, confusing log post-processing tools, and forging log entries. The issue is due to improper output neutralization for logs.(CVE-2024-1681)","status":"published","published":"2024-06-14T11:07:10Z","modified":"2026-08-18T01:17:23.624667113Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"PYSEC-2024-271","description":"corydolphin/flask-cors is vulnerable to log injection when the log level is set to debug. An attacker can inject fake log entries into the log file by sending a specially crafted GET request containing a CRLF sequence in the request path. This vulnerability allows attackers to corrupt log files, potentially covering tracks of other attacks, confusing log post-processing tools, and forging log entries. The issue is due to improper output neutralization for logs.","status":"published","published":"2024-04-19T20:15:09.273Z","modified":"2026-06-10T17:01:16.365143709Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:54.242332Z"},{"id":"UBUNTU-CVE-2024-1681","description":"corydolphin/flask-cors is vulnerable to log injection when the log level is set to debug. An attacker can inject fake log entries into the log file by sending a specially crafted GET request containing a CRLF sequence in the request path. This vulnerability allows attackers to corrupt log files, potentially covering tracks of other attacks, confusing log post-processing tools, and forging log entries. The issue is due to improper output neutralization for logs.","status":"published","published":"2024-04-19T20:15:00Z","modified":"2026-02-04T03:45:44.066445Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:54:42.68848Z"},{"id":"CLSA-2026-1789716215","title":"TuxCare security update for flask-cors (4 CVEs)","description":"TuxCare rebuilt flask-cors to address 4 CVEs. Fixed in 3.0.10.post1+tuxcare.","status":"published","published":"2026-09-18T07:23:35Z","modified":"2026-10-15T09:48:01.951381832Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"DLA-4197-1","title":"python-flask-cors - security update","status":"published","published":"2025-05-31T00:00:00Z","modified":"2026-03-09T01:19:26.362496Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"MGASA-2025-0286","title":"Updated python-flask-cors packages fix security vulnerabilities","description":"Log Injection Vulnerability in corydolphin/flask-cors. (CVE-2024-1681)\nImproper Access Control in corydolphin/flask-cors. (CVE-2024-6221)\nImproper Regex Path Matching in corydolphin/flask-cors. (CVE-2024-6839)\nInconsistent CORS Matching Due to Handling of '+' in URL Path in\ncorydolphin/flask-cors. (CVE-2024-6844)\nCase-Insensitive Path Matching in corydolphin/flask-cors.\n(CVE-2024-6866)\n","status":"published","published":"2025-11-13T18:03:54Z","modified":"2026-04-16T04:41:29.923155019Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2024:14293-1","title":"python310-Flask-Cors-4.0.1-1.1 on GA media","description":"These are all security issues fixed in the python310-Flask-Cors-4.0.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-08-29T00:00:00Z","modified":"2026-02-04T03:29:21.769674Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2026:11990-1","title":"python313-Flask-Cors-6.0.2-1.2 on GA media","description":"These are all security issues fixed in the python313-Flask-Cors-6.0.2-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-04T00:00:00Z","modified":"2026-10-05T10:15:29.650747711Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"ROOT-APP-PYPI-CVE-2024-1681","title":"CVE-2024-1681 in rootio-flask-cors - Patched by Root","description":"Root has patched CVE-2024-1681 in the rootio-flask-cors package for Root:PyPI. Multiple fixed versions available.","status":"published","published":"2026-07-20T07:17:42Z","modified":"2026-07-20T13:15:09.924959745Z","updated_at":"2026-11-02T15:53:27.940619Z"},{"id":"USN-7612-1","title":"python-flask-cors vulnerabilities","description":"It was discovered that Flask-CORS did not correctly handle certain regular\nexpressions. A remote attacker could possibly use this issue to leak\nsensitive information or bypass authentication mechanisms. (CVE-2024-6839)\nIt was discovered that Flask-CORS allowed certain CORS headers to be\nenabled by default. A remote attacker could possibly use this issue to leak\nsensitive information. This issue only affected Ubuntu 20.04 LTS, Ubuntu\n22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 24.10. (CVE-2024-6221)  It was\ndiscovered that Flask-CORS did not correctly handle case sensitivity when\nmatching paths. A remote attacker could possibly use this issue to leak\nsensitive information. (CVE-2024-6866)  It was discovered that Flask-CORS\ndid not correctly handle certain characters in URL paths. A remote attacker\ncould possibly use this issue to leak sensitive information or bypass\nauthentication mechanisms. (CVE-2024-6844)  Elias Hohl was discovered that\nFlask-CORS did not correctly sanitize log entries. A remote attacker could\npossibly use this issue to corrupt log files. This issue only affected\nUbuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-1681)","status":"published","published":"2025-07-02T04:59:38Z","modified":"2026-04-27T18:08:36.001433Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}