~ / search / GHSA-hxwh-jpp2-84pm

GHSA-hxwh-jpp2-84pm

Flask-CORS allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default

Source: GitHub Advisory Database (reviewed) High CVE-2024-6221

Packages

EcosystemPackageAffectedFixed in
PyPI Flask-Cors < 4.0.2 4.0.2

Details

As written in the advisory (Markdown source, shown as plain text).

A vulnerability in corydolphin/flask-cors version 4.0.1 allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default, without any configuration option. This behavior can expose private network resources to unauthorized external access, leading to significant security risks such as data breaches, unauthorized access to sensitive information, and potential network intrusions.

References

External links from the advisory. They lead to third-party sites.