CVE-2024-6844

A vulnerability in corydolphin/flask-cors version 4.0.1 allows for inconsistent CORS matching due to the handling of the '+' character in URL paths. The request.path is passed through the unquote_plus function, which converts the '+' character to a space ' '. This behavior leads to incorrect path normalization, causing potential mismatches in CORS configuration. As a result, endpoints may not be matched correctly to their CORS settings, leading to unexpected CORS policy application. This can cause unauthorized cross-origin access or block valid requests, creating security vulnerabilities and usability issues.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://huntr.com/bounties/731a6cd4-d05f-4fe6-8f5b-fe088d7b34e0	Exploit Third Party Advisory
https://lists.debian.org/debian-lts-announce/2025/05/msg00049.html

Configurations

Configuration 1 (hide)

cpe:2.3:a:flask-cors_project:flask-cors:4.0.1:*:*:*:*:*:*:*

History

03 Nov 2025, 20:17

Type	Values Removed	Values Added
References		() https://lists.debian.org/debian-lts-announce/2025/05/msg00049.html -

Information

Published : 2025-03-20 10:15

Updated : 2025-11-03 20:17

NVD link : CVE-2024-6844

Mitre link : CVE-2024-6844

CVE.ORG link : CVE-2024-6844

JSON object : View

Products Affected

flask-cors_project

flask-cors

CWE

CWE-346

Origin Validation Error

{"id": "CVE-2024-6844", "cveTags": [], "metrics": {"cvssMetricV30": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2025-03-20T10:15:34.120", "references": [{"url": "https://huntr.com/bounties/731a6cd4-d05f-4fe6-8f5b-fe088d7b34e0", "tags": ["Exploit", "Third Party Advisory"], "source": "[email protected]"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00049.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-346"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in corydolphin/flask-cors version 4.0.1 allows for inconsistent CORS matching due to the handling of the '+' character in URL paths. The request.path is passed through the unquote_plus function, which converts the '+' character to a space ' '. This behavior leads to incorrect path normalization, causing potential mismatches in CORS configuration. As a result, endpoints may not be matched correctly to their CORS settings, leading to unexpected CORS policy application. This can cause unauthorized cross-origin access or block valid requests, creating security vulnerabilities and usability issues."}, {"lang": "es", "value": "Una vulnerabilidad en corydolphin/flask-cors versi\u00f3n 4.0.1 permite coincidencias CORS inconsistentes debido a la gesti\u00f3n del car\u00e1cter \"+\" en las rutas URL. El archivo request.path se pasa a trav\u00e9s de la funci\u00f3n unquote_plus, que convierte el car\u00e1cter \"+\" en un espacio. Este comportamiento provoca una normalizaci\u00f3n incorrecta de las rutas, lo que puede provocar discrepancias en la configuraci\u00f3n CORS. Como resultado, los endpoints podr\u00edan no coincidir correctamente con su configuraci\u00f3n CORS, lo que provoca la aplicaci\u00f3n inesperada de pol\u00edticas CORS. Esto puede provocar accesos no autorizados entre or\u00edgenes o bloquear solicitudes v\u00e1lidas, creando vulnerabilidades de seguridad y problemas de usabilidad."}], "lastModified": "2025-11-03T20:17:04.007", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:flask-cors_project:flask-cors:4.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9B39A789-3A63-4B10-A09D-2E08E7F36F1B"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}