affected:
- package:
    ecosystem: PyPI
    name: flask-cors
    purl: pkg:pypi/flask-cors
  ranges:
  - events:
    - introduced: '0'
    - fixed: 4.0.2
    type: ECOSYSTEM
  versions:
  - '1.0'
  - '1.1'
  - 1.1.1
  - 1.1.2
  - 1.1.3
  - 1.10.0
  - 1.10.1
  - 1.10.2
  - 1.10.3
  - 1.2.0
  - 1.2.1
  - 1.3.0
  - 1.3.1
  - 1.4.0
  - 1.5.0
  - 1.6.0
  - 1.6.1
  - 1.7.0
  - 1.7.1
  - 1.7.2
  - 1.7.3
  - 1.7.4
  - 1.8.0
  - 1.8.1
  - 1.9.0
  - 2.0.0
  - 2.0.0rc1
  - 2.0.1
  - 2.1.0
  - 2.1.1
  - 2.1.2
  - 2.1.3
  - 3.0.0
  - 3.0.1
  - 3.0.10
  - 3.0.2
  - 3.0.3
  - 3.0.4
  - 3.0.6
  - 3.0.7
  - 3.0.8
  - 3.0.9
  - 4.0.0
  - 4.0.0a0
  - 4.0.1
  - 0.0.0.dev3
  - 0.0.0.dev4
aliases:
- CVE-2024-6221
- GHSA-hxwh-jpp2-84pm
details: A vulnerability in corydolphin/flask-cors up to version 4.0.1 allows the
  `Access-Control-Allow-Private-Network` CORS header to be set to true by default,
  without any configuration option. This behavior can expose private network resources
  to unauthorized external access, leading to significant security risks such as data
  breaches, unauthorized access to sensitive information, and potential network intrusions.
id: PYSEC-2024-71
modified: '2026-06-10T16:51:23.355600Z'
published: '2024-08-18T19:15:00Z'
references:
- type: EVIDENCE
  url: https://huntr.com/bounties/a42935fc-6f57-4818-bca4-3d528235df4d
- type: WEB
  url: https://huntr.com/bounties/a42935fc-6f57-4818-bca4-3d528235df4d
- type: WEB
  url: https://github.com/corydolphin/flask-cors/commit/7ae310c56ac30e0b94fb42129aa377bf633256ec
- type: ADVISORY
  url: https://github.com/advisories/GHSA-hxwh-jpp2-84pm
severity:
- score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
  type: CVSS_V3