affected:
- ecosystem_specific: {}
  package:
    ecosystem: PyPI
    name: flask-cors
    purl: pkg:pypi/flask-cors
  ranges:
  - events:
    - introduced: '0'
    - last_affected: 4.0.0
    type: ECOSYSTEM
  versions:
  - 0.0.0.dev3
  - 0.0.0.dev4
  - '1.0'
  - '1.1'
  - 1.1.1
  - 1.1.2
  - 1.1.3
  - 1.10.0
  - 1.10.1
  - 1.10.2
  - 1.10.3
  - 1.2.0
  - 1.2.1
  - 1.3.0
  - 1.3.1
  - 1.4.0
  - 1.5.0
  - 1.6.0
  - 1.6.1
  - 1.7.0
  - 1.7.1
  - 1.7.2
  - 1.7.3
  - 1.7.4
  - 1.8.0
  - 1.8.1
  - 1.9.0
  - 2.0.0
  - 2.0.0rc1
  - 2.0.1
  - 2.1.0
  - 2.1.1
  - 2.1.2
  - 2.1.3
  - 3.0.0
  - 3.0.1
  - 3.0.10
  - 3.0.2
  - 3.0.3
  - 3.0.4
  - 3.0.6
  - 3.0.7
  - 3.0.8
  - 3.0.9
  - 4.0.0
  - 4.0.0a0
aliases:
- CVE-2024-1681
- GHSA-84pr-m4jr-85g5
details: corydolphin/flask-cors is vulnerable to log injection when the log level
  is set to debug. An attacker can inject fake log entries into the log file by sending
  a specially crafted GET request containing a CRLF sequence in the request path.
  This vulnerability allows attackers to corrupt log files, potentially covering tracks
  of other attacks, confusing log post-processing tools, and forging log entries.
  The issue is due to improper output neutralization for logs.
id: PYSEC-2024-271
modified: '2026-05-21T14:54:28.903948Z'
published: '2024-04-19T20:15:09.273Z'
references:
- type: WEB
  url: https://lists.debian.org/debian-lts-announce/2025/05/msg00049.html
- type: EVIDENCE
  url: https://huntr.com/bounties/25a7a0ba-9fa2-4777-acb6-03e5539bb644
- type: ADVISORY
  url: https://github.com/advisories/GHSA-84pr-m4jr-85g5
severity:
- score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
  type: CVSS_V3