CVE-2024-6839: Improper Regex Path Matching in corydolphin/flask-cors
corydolphin/flask-cors version 4.0.1 contains an improper regex path matching vulnerability. The plugin prioritizes longer regex patterns over more specific ones when matching paths, which can lead to less restrictive CORS policies being applied to sensitive endpoints. This mismatch in regex pattern priority allows unauthorized cross-origin access to sensitive data or functionality, potentially exposing confidential information and increasing the risk of unauthorized actions by malicious actors.
Other sources
corydolphin/flask-cors version 5.0.1 contains an improper regex path matching vulnerability. The plugin prioritizes longer regex patterns over more specific ones when matching paths, which can lead to less restrictive CORS policies being applied to sensitive endpoints. This mismatch in regex pattern priority allows unauthorized cross-origin access to sensitive data or functionality, potentially exposing confidential information and increasing the risk of unauthorized actions by malicious actors.
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-6839?
CVE-2024-6839 has a critical severity due to its impact on CORS policies for sensitive endpoints.
How do I fix CVE-2024-6839?
To fix CVE-2024-6839, update flask-cors to version 4.0.2 or later where the regex path matching vulnerability is addressed.
What causes the vulnerability in CVE-2024-6839?
The vulnerability in CVE-2024-6839 is caused by the improper prioritization of longer regex patterns over more specific ones when matching paths.
Which versions of flask-cors are affected by CVE-2024-6839?
CVE-2024-6839 affects flask-cors version 4.0.1 and earlier versions.
How does CVE-2024-6839 affect web application security?
CVE-2024-6839 can compromise web application security by enabling less restrictive CORS policies, potentially exposing sensitive data.