{"id":"CVE-2024-6221","aliases":["DEBIAN-CVE-2024-6221","EUVD-2024-0061","GHSA-hxwh-jpp2-84pm","MGASA-2025-0286","OESA-2024-2198","PYSEC-2024-260","PYSEC-2024-71","ROOT-APP-PYPI-CVE-2024-6221","UBUNTU-CVE-2024-6221","USN-7612-1"],"status":"published","title":"Improper Access Control in corydolphin/flask-cors","description":"A vulnerability in corydolphin/flask-cors version 4.0.1 allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default. This behavior can expose private network resources to unauthorized external access, leading to significant security risks such as data breaches, unauthorized access to sensitive information, and potential network intrusions.","severity":{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00718,"percentile":0.54186,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-284"],"published":"2024-08-18T18:58:20Z","modified":"2026-11-02T12:03:11Z","fixes":[{"ecosystem":"PyPI","package":"flask-cors","fixed_in":["4.0.2"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:13","package":"python-flask-cors","fixed_in":["5.0.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-flask-cors","fixed_in":["5.0.0-1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"python-Flask-Cors","fixed_in":["5.0.0-1.oe2403"],"sources":["osv"]},{"ecosystem":"Root:PyPI","package":"rootio-flask-cors","fixed_in":["3.0.10+root.io.1","3.0.10+root.io.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python-flask-cors","fixed_in":["3.0.8-2ubuntu0.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"python-flask-cors","fixed_in":["3.0.9-2ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"python-flask-cors","fixed_in":["4.0.0-1ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"flask-cors","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"python-flask-cors","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"python-flask-cors","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.0-1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"flask-cors","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2"}]}],"versions":["0.0.0.dev3","0.0.0.dev4","1.0","1.1","1.1.1","1.1.2","1.1.3","1.10.0","1.10.1","1.10.2","1.10.3","1.2.0","1.2.1","1.3.0","1.3.1","1.4.0","1.5.0","1.6.0","1.6.1","1.7.0","1.7.1","1.7.2","1.7.3","1.7.4","1.8.0","1.8.1","1.9.0","2.0.0","2.0.0rc1","2.0.1","2.1.0","2.1.1","2.1.2","2.1.3","3.0.0","3.0.1","3.0.10","3.0.2","3.0.3","3.0.4","3.0.6","3.0.7","3.0.8","3.0.9","4.0.0","4.0.0a0","4.0.1"]},{"source":"osv","ecosystem":"Mageia:9","package":"python-flask-cors","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.10-1.1.mga9"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"python-Flask-Cors","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.0-1.oe2403"}]}]},{"source":"osv","ecosystem":"PyPI","package":"flask-cors","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2"}]}],"versions":["0.0.0.dev3","0.0.0.dev4","1.0","1.1","1.1.1","1.1.2","1.1.3","1.10.0","1.10.1","1.10.2","1.10.3","1.2.0","1.2.1","1.3.0","1.3.1","1.4.0","1.5.0","1.6.0","1.6.1","1.7.0","1.7.1","1.7.2","1.7.3","1.7.4","1.8.0","1.8.1","1.9.0","2.0.0","2.0.0rc1","2.0.1","2.1.0","2.1.1","2.1.2","2.1.3","3.0.0","3.0.1","3.0.10","3.0.2","3.0.3","3.0.4","3.0.6","3.0.7","3.0.8","3.0.9","4.0.0","4.0.0a0","4.0.1"]},{"source":"osv","ecosystem":"Root:PyPI","package":"rootio-flask-cors","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.10+root.io.1"},{"fixed":"3.0.10+root.io.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python-flask-cors","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-2ubuntu0.1+esm1"}]}],"versions":["3.0.8-2","3.0.8-2ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"python-flask-cors","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.9-2ubuntu0.1"}]}],"versions":["3.0.9-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"python-flask-cors","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.0-1ubuntu0.1~esm1"}]}],"versions":["4.0.0-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python-flask-cors","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-2ubuntu0.1+esm1"}]}],"versions":["3.0.8-2","3.0.8-2ubuntu0.1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"python-flask-cors","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.9-2ubuntu0.1"}]}],"versions":["3.0.9-2"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"python-flask-cors","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.0-1ubuntu0.1~esm1"}]}],"versions":["4.0.0-1"],"bundled":5}],"products":[{"vendor":"corydolphin","product":"corydolphin/flask-cors"},{"vendor":"corydolphin","product":"flask-cors"}],"references":[{"url":"https://huntr.com/bounties/a42935fc-6f57-4818-bca4-3d528235df4d","tags":["Exploit","Third Party Advisory","web","evidence","report"]},{"url":"https://github.com/corydolphin/flask-cors/commit/03aa3f8e2256437f7bad96422a747b98ab5e31bf","tags":["fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-6221","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/flask-cors/PYSEC-2024-71.yaml","tags":["web"]},{"url":"https://github.com/corydolphin/flask-cors/issues/362","tags":["web"]},{"url":"https://github.com/corydolphin/flask-cors/pull/363","tags":["web"]},{"url":"https://github.com/corydolphin/flask-cors/pull/368","tags":["web"]},{"url":"https://github.com/corydolphin/flask-cors/commit/c8514760cf03fcce16d77f6db7007aad429c4548","tags":["web"]},{"url":"https://github.com/corydolphin/flask-cors/releases","tags":["web"]},{"url":"https://github.com/corydolphin/flask-cors/commit/7ae310c56ac30e0b94fb42129aa377bf633256ec","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/flask-cors/PYSEC-2024-260.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-hxwh-jpp2-84pm","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/6xxx/CVE-2024-6221.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-6221","tags":["advisory"]},{"url":"https://github.com/corydolphin/flask-cors","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2025-0286.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=34424","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7612-1","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2198","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-6221","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-6221","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-1681","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-6839","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-6844","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-6866","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-6221","title":"Improper Access Control in corydolphin/flask-cors","description":"A vulnerability in corydolphin/flask-cors version 4.0.1 allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default. This behavior can expose private network resources to unauthorized external access, leading to significant security risks such as data breaches, unauthorized access to sensitive information, and potential network intrusions.","status":"published","published":"2024-08-18T18:58:20.551Z","modified":"2025-04-07T15:03:37.262Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:34:11.305983Z"}],"euvd":[{"id":"EUVD-2024-0061","description":"A vulnerability in corydolphin/flask-cors version 4.0.1 allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default. This behavior can expose private network resources to unauthorized external access, leading to significant security risks such as data breaches, unauthorized access to sensitive information, and potential network intrusions.","status":"published","published":"2024-08-18T18:58:20Z","modified":"2025-04-07T15:03:37Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T20:52:41.59184Z"}],"ghsa":[{"id":"GHSA-hxwh-jpp2-84pm","title":"Flask-CORS allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default","description":"A vulnerability in corydolphin/flask-cors version 4.0.1 allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default, without any configuration option. This behavior can expose private network resources to unauthorized external access, leading to significant security risks such as data breaches, unauthorized access to sensitive information, and potential network intrusions.","status":"published","published":"2024-08-18T21:31:07Z","modified":"2026-05-19T20:20:53Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:40:12.430932Z"}],"nvd":[{"id":"CVE-2024-6221","description":"A vulnerability in corydolphin/flask-cors version 4.0.1 allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default. This behavior can expose private network resources to unauthorized external access, leading to significant security risks such as data breaches, unauthorized access to sensitive information, and potential network intrusions.","status":"published","published":"2024-08-18T19:15:04.73Z","modified":"2026-06-17T08:17:32.65Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:10:19.135392Z"}],"osv":[{"id":"CVE-2024-6221","title":"Improper Access Control in corydolphin/flask-cors","description":"A vulnerability in corydolphin/flask-cors version 4.0.1 allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default. This behavior can expose private network resources to unauthorized external access, leading to significant security risks such as data breaches, unauthorized access to sensitive information, and potential network intrusions.","status":"published","published":"2024-08-18T18:58:20.551Z","modified":"2026-10-28T02:30:40.915365199Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T15:44:45.107804Z"},{"id":"DEBIAN-CVE-2024-6221","description":"A vulnerability in corydolphin/flask-cors version 4.0.1 allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default. This behavior can expose private network resources to unauthorized external access, leading to significant security risks such as data breaches, unauthorized access to sensitive information, and potential network intrusions.","status":"published","published":"2024-08-18T19:15:04.73Z","modified":"2026-11-02T12:03:11.951161916Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:44.747956Z"},{"id":"GHSA-hxwh-jpp2-84pm","title":"Flask-CORS allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default","description":"A vulnerability in corydolphin/flask-cors version 4.0.1 allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default, without any configuration option. This behavior can expose private network resources to unauthorized external access, leading to significant security risks such as data breaches, unauthorized access to sensitive information, and potential network intrusions.","status":"published","published":"2024-08-18T21:31:07Z","modified":"2026-09-10T03:50:18.161615963Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T15:46:49.621585Z"},{"id":"OESA-2024-2198","title":"python-Flask-Cors security update","description":"A Flask extension for handling Cross Origin Resource Sharing (CORS), making cross-origin AJAX possible.\r\n\r\nSecurity Fix(es):\r\n\r\nA vulnerability in corydolphin/flask-cors version 4.0.1 allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default, without any configuration option. This behavior can expose private network resources to unauthorized external access, leading to significant security risks such as data breaches, unauthorized access to sensitive information, and potential network intrusions.(CVE-2024-6221)","status":"published","published":"2024-09-27T11:07:40Z","modified":"2026-08-18T01:18:37.249530907Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"PYSEC-2024-260","description":"Withdrawn as duplicate of PYSEC-2024-71. A vulnerability in corydolphin/flask-cors version 4.0.1 allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default. This behavior can expose private network resources to unauthorized external access, leading to significant security risks such as data breaches, unauthorized access to sensitive information, and potential network intrusions.","status":"withdrawn","published":"2024-08-18T19:15:04.73Z","modified":"2026-07-09T16:45:06.434871287Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:54.242332Z"},{"id":"PYSEC-2024-71","description":"A vulnerability in corydolphin/flask-cors up to version 4.0.1 allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default, without any configuration option. This behavior can expose private network resources to unauthorized external access, leading to significant security risks such as data breaches, unauthorized access to sensitive information, and potential network intrusions.","status":"published","published":"2024-08-18T19:15:00Z","modified":"2026-07-09T16:56:25.795378335Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:54.242332Z"},{"id":"UBUNTU-CVE-2024-6221","description":"A vulnerability in corydolphin/flask-cors version 4.0.1 allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default. This behavior can expose private network resources to unauthorized external access, leading to significant security risks such as data breaches, unauthorized access to sensitive information, and potential network intrusions.","status":"published","published":"2024-08-18T19:15:00Z","modified":"2026-02-04T02:57:09.588784Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T16:55:18.664792Z"},{"id":"MGASA-2025-0286","title":"Updated python-flask-cors packages fix security vulnerabilities","description":"Log Injection Vulnerability in corydolphin/flask-cors. (CVE-2024-1681)\nImproper Access Control in corydolphin/flask-cors. (CVE-2024-6221)\nImproper Regex Path Matching in corydolphin/flask-cors. (CVE-2024-6839)\nInconsistent CORS Matching Due to Handling of '+' in URL Path in\ncorydolphin/flask-cors. (CVE-2024-6844)\nCase-Insensitive Path Matching in corydolphin/flask-cors.\n(CVE-2024-6866)\n","status":"published","published":"2025-11-13T18:03:54Z","modified":"2026-04-16T04:41:29.923155019Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"ROOT-APP-PYPI-CVE-2024-6221","title":"CVE-2024-6221 in rootio-flask-cors - Patched by Root","description":"Root has patched CVE-2024-6221 in the rootio-flask-cors package for Root:PyPI. Multiple fixed versions available.","status":"published","published":"2026-07-20T07:17:42Z","modified":"2026-07-20T13:15:15.289945704Z","updated_at":"2026-11-02T15:53:27.940619Z"},{"id":"USN-7612-1","title":"python-flask-cors vulnerabilities","description":"It was discovered that Flask-CORS did not correctly handle certain regular\nexpressions. A remote attacker could possibly use this issue to leak\nsensitive information or bypass authentication mechanisms. (CVE-2024-6839)\nIt was discovered that Flask-CORS allowed certain CORS headers to be\nenabled by default. A remote attacker could possibly use this issue to leak\nsensitive information. This issue only affected Ubuntu 20.04 LTS, Ubuntu\n22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 24.10. (CVE-2024-6221)  It was\ndiscovered that Flask-CORS did not correctly handle case sensitivity when\nmatching paths. A remote attacker could possibly use this issue to leak\nsensitive information. (CVE-2024-6866)  It was discovered that Flask-CORS\ndid not correctly handle certain characters in URL paths. A remote attacker\ncould possibly use this issue to leak sensitive information or bypass\nauthentication mechanisms. (CVE-2024-6844)  Elias Hohl was discovered that\nFlask-CORS did not correctly sanitize log entries. A remote attacker could\npossibly use this issue to corrupt log files. This issue only affected\nUbuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-1681)","status":"published","published":"2025-07-02T04:59:38Z","modified":"2026-04-27T18:08:36.001433Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}