CVE-2024-6866

Katalog CVE

CVSS 7.5 · High EPSS 0,72%

Kerentanan Improper Handling of Case Sensitivity pada flask-cors project flask-cors. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

corydolphin/flask-cors version 4.01 contains a vulnerability where the request path matching is case-insensitive due to the use of the `try_match` function, which is originally intended for matching hosts. This results in a mismatch because paths in URLs are case-sensitive, but the regex matching treats them as case-insensitive. This misconfiguration can lead to significant security vulnerabilities, allowing unauthorized origins to access paths meant to be restricted, resulting in data exposure and potential data leaks.

Rincian

Terbit di NVD

20 Maret 2025

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-178: Improper Handling of Case Sensitivity

EPSS (30 hari)

0,72% peluang dieksploitasi; lebih tinggi dari 52,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://huntr.com/bounties/808c11af-faee-43a8-824b-b5ab4f62b9e6 exploit · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2025/05/msg00049.html