netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-43qf-4rqw-9q2g
GHSA-8vgw-p6qm-5gr7
This commit is contained in:
advisory-database[bot]
2025-05-17 18:56:29 +00:00
parent 1567dd1998
commit 384993f0be
2 changed files with 22 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2025/03/GHSA-43qf-4rqw-9q2g/GHSA-43qf-4rqw-9q2g.json
+11 -4
View File
@@ -1,13 +1,13 @@
{
"schema_version": "1.4.0",
"id": "GHSA-43qf-4rqw-9q2g",
"modified": "2025-03-21T22:16:04Z",
"modified": "2025-05-17T18:55:57Z",
"published": "2025-03-20T12:32:45Z",
"aliases": [
"CVE-2024-6866"
],
"summary": "Flask-CORS vulnerable to Improper Handling of Case Sensitivity",
"details": "corydolphin/flask-cors version 4.0.1 contains a vulnerability where the request path matching is case-insensitive due to the use of the `try_match` function, which is originally intended for matching hosts. This results in a mismatch because paths in URLs are case-sensitive, but the regex matching treats them as case-insensitive. This misconfiguration can lead to significant security vulnerabilities, allowing unauthorized origins to access paths meant to be restricted, resulting in data exposure and potential data leaks.",
"details": "corydolphin/flask-cors version 5.0.1 contains a vulnerability where the request path matching is case-insensitive due to the use of the `try_match` function, which is originally intended for matching hosts. This results in a mismatch because paths in URLs are case-sensitive, but the regex matching treats them as case-insensitive. This misconfiguration can lead to significant security vulnerabilities, allowing unauthorized origins to access paths meant to be restricted, resulting in data exposure and potential data leaks.",
"severity": [
{
"type": "CVSS_V3",
@@ -28,11 +28,14 @@
"introduced": "0"
},
{
"last_affected": "4.0.1"
"fixed": "6.0.0"
}
]
}
]
],
"database_specific": {
"last_known_affected_version_range": "<= 5.0.1"
}
}
],
"references": [
@@ -40,6 +43,10 @@
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6866"
},
{
"type": "WEB",
"url": "https://github.com/corydolphin/flask-cors/commit/eb39516a3c96b90d0ae5f51293972395ec3ef358"
},
{
"type": "PACKAGE",
"url": "https://github.com/corydolphin/flask-cors"
advisories/github-reviewed/2025/03/GHSA-8vgw-p6qm-5gr7/GHSA-8vgw-p6qm-5gr7.json
+11 -4
View File
@@ -1,13 +1,13 @@
{
"schema_version": "1.4.0",
"id": "GHSA-8vgw-p6qm-5gr7",
"modified": "2025-03-21T22:10:24Z",
"modified": "2025-05-17T18:54:45Z",
"published": "2025-03-20T12:32:45Z",
"aliases": [
"CVE-2024-6844"
],
"summary": "Flask-CORS allows for inconsistent CORS matching",
"details": "A vulnerability in corydolphin/flask-cors version 4.0.1 allows for inconsistent CORS matching due to the handling of the '+' character in URL paths. The request.path is passed through the unquote_plus function, which converts the '+' character to a space ' '. This behavior leads to incorrect path normalization, causing potential mismatches in CORS configuration. As a result, endpoints may not be matched correctly to their CORS settings, leading to unexpected CORS policy application. This can cause unauthorized cross-origin access or block valid requests, creating security vulnerabilities and usability issues.",
"details": "A vulnerability in corydolphin/flask-cors version 5.0.1 allows for inconsistent CORS matching due to the handling of the '+' character in URL paths. The request.path is passed through the unquote_plus function, which converts the '+' character to a space ' '. This behavior leads to incorrect path normalization, causing potential mismatches in CORS configuration. As a result, endpoints may not be matched correctly to their CORS settings, leading to unexpected CORS policy application. This can cause unauthorized cross-origin access or block valid requests, creating security vulnerabilities and usability issues.",
"severity": [
{
"type": "CVSS_V3",
@@ -28,11 +28,14 @@
"introduced": "0"
},
{
"last_affected": "4.0.1"
"fixed": "6.0.0"
}
]
}
]
],
"database_specific": {
"last_known_affected_version_range": "<= 5.0.1"
}
}
],
"references": [
@@ -40,6 +43,10 @@
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6844"
},
{
"type": "WEB",
"url": "https://github.com/corydolphin/flask-cors/commit/35d875319621bd129a38b2b823abf4a2f6cda536"
},
{
"type": "PACKAGE",
"url": "https://github.com/corydolphin/flask-cors"