CVE-2024-6221: corydolphin corydolphin/flask-cors Improper Access Control
Vulnerability summary
CVE-2024-6221 is a high (CVSS 7.5) Improper Access Control vulnerability in corydolphin corydolphin/flask-cors. EPSS estimates a 0.72% chance of exploitation in the next 30 days, higher than 53% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 2 · Related 3Timeline
- 18-08-2024PublishedVulnerability first disclosed.
- 07-04-2025Last modifiedVulnerability information updated.
Description
A vulnerability in corydolphin/flask-cors version 4.0.1 allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default. This behavior can expose private network resources to unauthorized external access, leading to significant security risks such as data breaches, unauthorized access to sensitive information, and potential network intrusions.
CVSS metrics
9 scores · 7 sources · 2 versions- OSV · PypiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
- OSV · WolfiEcosystem advisory · calculated6.5MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
- OSV · ChainguardEcosystem advisory · calculated6.5MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
- NVDNIST6.5MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
EPSS trend
Probability
0.72%
Chance of exploitation in the next 30 days
Percentile
53%
Versus all other CVEs
30-day change
0.00 pp
From 0.72% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (huntr.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Chainguard8 products
- kubeflow-jupyter-web-app< 1.9.1-r0
- kubeflow-volumes-web-app< 1.9.1-r0
- py3-flask-cors< 4.0.2-r0
- py3-supported-flask-cors< 4.0.2-r0
- py3.10-flask-cors< 4.0.2-r0
Wolfi8 products
- kubeflow-jupyter-web-app< 1.9.1-r0
- kubeflow-volumes-web-app< 1.9.1-r0
- py3-flask-cors< 4.0.2-r0
- py3-supported-flask-cors< 4.0.2-r0
- py3.10-flask-cors< 4.0.2-r0
Corydolphin2 products
- corydolphin/flask-cors≥ unspecified, < 5.0.0
- flask-cors4.0.1
Debian1 product
- python-flask-cors< 5.0.0-1
PyPI1 product
- flask-cors≤ 4.0.1 | < 4.0.2
Ubuntu1 product
- python-flask-cors< 3.0.8-2ubuntu0.1+esm1 | < 3.0.9-2ubuntu0.1 | < 4.0.0-1ubuntu0.1~esm1
6 vendors · 21 products
