A vulnerability in corydolphin/flask-cors version 4.0.1 allows for inconsistent CORS matching due to the handling of the + character in URL paths. The request.path is passed through the unquote_plus function, which converts the + character to a space . This behavior leads to incorrect path normalization, causing potential mismatches in CORS configuration. As a result, endpoints may not be matched correctly to their CORS settings, leading to unexpected CORS policy application. This can cause unauthorized cross-origin access or block valid requests, creating security vulnerabilities and usability issues.
Weakness
The product does not properly verify that the source of data or communication is valid.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Flask-cors | Flask-cors_project | 4.0.1 (including) | 4.0.1 (including) |
| Python-flask-cors | Ubuntu | esm-apps/focal | * |
| Python-flask-cors | Ubuntu | esm-apps/jammy | * |
| Python-flask-cors | Ubuntu | esm-apps/noble | * |
| Python-flask-cors | Ubuntu | focal | * |
| Python-flask-cors | Ubuntu | jammy | * |
| Python-flask-cors | Ubuntu | noble | * |
| Python-flask-cors | Ubuntu | oracular | * |
| Python-flask-cors | Ubuntu | plucky | * |
| Python-flask-cors | Ubuntu | upstream | * |
Related Attack Patterns
- https://cwe.mitre.org/data/definitions/111.html
- https://cwe.mitre.org/data/definitions/141.html
- https://cwe.mitre.org/data/definitions/142.html
- https://cwe.mitre.org/data/definitions/160.html
- https://cwe.mitre.org/data/definitions/21.html
- https://cwe.mitre.org/data/definitions/384.html
- https://cwe.mitre.org/data/definitions/385.html
- https://cwe.mitre.org/data/definitions/386.html
- https://cwe.mitre.org/data/definitions/387.html
- https://cwe.mitre.org/data/definitions/388.html
- https://cwe.mitre.org/data/definitions/510.html
- https://cwe.mitre.org/data/definitions/59.html
- https://cwe.mitre.org/data/definitions/60.html
- https://cwe.mitre.org/data/definitions/75.html
- https://cwe.mitre.org/data/definitions/76.html
- https://cwe.mitre.org/data/definitions/89.html