Improper Handling of Case Sensitivity in Flask-CORS - CVE-2024-6866

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU112142

Improper Handling of Case Sensitivity in Flask-CORS - CVE-2024-6866

Published: July 3, 2025


Vulnerability identifier: #VU112142
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-6866
CWE-ID: CWE-178
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to usage of a case sensitive try_match() function on the attacker-controlled URI. A remote attacker can bypass implemented security checks and gain unauthorized access to sensitive data. 



Affected software

Flask-CORS
IBM Cloud Pak for Data System
IBM Maximo Application Suite
watsonx.data
Maximo Application Suite - Visual Inspection Component
Ubuntu
openEuler
python-flask-cors (Ubuntu package)
python-Flask-Cors-help
python3-Flask-Cors
python-Flask-Cors

How to mitigate CVE-2024-6866

Install updates from vendor's website.

Flask-CORS - update to 6.0.0
IBM Cloud Pak for Data System - update to 1.0.10.0
watsonx.data - update to 2.3.1
Maximo Application Suite - Visual Inspection Component - update to 9.0.8
python-flask-cors (Ubuntu package) - addressed in versions 3.0.8-2ubuntu0.1+esm1, 3.0.9-2ubuntu0.1, 4.0.0-1ubuntu0.1~esm1, 4.0.1-1ubuntu0.1, 5.0.0-1ubuntu0.1
python-Flask-Cors-help - update to 6.0.1-1
python3-Flask-Cors - update to 6.0.1-1
python-Flask-Cors - update to 6.0.1-1
IBM Maximo Application Suite - addressed in versions 8.10.27, 8.11.24, 9.0.13, 9.1.1

External References

Related Security Bulletins