CVE-2024-1681
Medium
Description
corydolphin/flask-cors is vulnerable to log injection when the log level is set to debug. An attacker can inject fake log entries into the log file by sending a specially crafted GET request containing a CRLF sequence in the request path. This vulnerability allows attackers to corrupt log files, potentially covering tracks of other attacks, confusing log post-processing tools, and forging log entries. The issue is due to improper output neutralization for logs.
SeverityMedium
CVSS5.3
Exploit probability—
ProductCorydolphin Flask-cors
PublishedApr 19, 2024
First seenApr 19, 2024
Weakness typeCWE-117CWE-117
How to fix
Update
- flask-cors4.0.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| corydolphin flask-cors | 4.0.0 | — |
| flask-corsPyPI | v < 4.0.1, v ≤ 4.0.0 | 4.0.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.