Workflow

PyPi: Flask-Cors

CVE-2024-1681

Safety vulnerability ID: 70813

This vulnerability was reviewed by experts

The information on this page was manually curated by our Cybersecurity Intelligence Team.

Created at Apr 19, 2024 Updated at May 06, 2024
Scan your Python projects for vulnerabilities →

Advisory

Flask-cors 4.0.1 addresses the CVE-2024-1681: corydolphin/flask-cors is vulnerable to log injection when the log level is set to debug. An attacker can inject fake log entries into the log file by sending a specially crafted GET request containing a CRLF sequence in the request path. This vulnerability allows attackers to corrupt log files, potentially covering tracks of other attacks, confusing log post-processing tools, and forging log entries. The issue is due to improper output neutralization for logs.

Affected package

flask-cors

Latest version: 4.0.1

A Flask extension adding a decorator for CORS support

Affected versions

Fixed versions

Vulnerability changelog

Security
* Address [CVE-2024-1681](https://github.com/advisories/GHSA-84pr-m4jr-85g5) which is a log injection vulnerability when the log level is set to debug by aneshujevic in https://github.com/corydolphin/flask-cors/pull/351

Resources

Use this package?

Scan your Python project for dependency vulnerabilities in two minutes

Scan your application