Improper Output Neutralization for Logs in Flask-CORS - CVE-2024-1681

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU94747

Improper Output Neutralization for Logs in Flask-CORS - CVE-2024-1681

Published: July 26, 2024


Vulnerability identifier: #VU94747
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-1681
CWE-ID: CWE-117
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to modify data on the system.

The vulnerability exists due to excessive data output by the application. A remote attacker can send a specially crafted GET request containing a CRLF sequence in the request path to inject fake log entries into the log file.


Affected software

Flask-CORS
IBM Cloud Pak for Data System
Qradar Advisor
IBM Maximo Application Suite
watsonx.data
Maximo Application Suite - Visual Inspection Component
Ubuntu
openEuler
Fedora
QRadar Suite
python-flask-cors (Ubuntu package)
python-Flask-Cors
python-Flask-Cors-help
python3-Flask-Cors
python-flask-cors

How to mitigate CVE-2024-1681

Install updates from vendor's website.

Flask-CORS - update to 4.0.1
IBM Cloud Pak for Data System - update to 2.0.2.1.IF2
watsonx.data - update to 2.3.1
Maximo Application Suite - Visual Inspection Component - update to 9.0.3
QRadar Suite - update to 1.10.22.0
Qradar Advisor - update to 2.6.6
python-flask-cors (Ubuntu package) - addressed in versions 3.0.8-2ubuntu0.1+esm1, 3.0.9-2ubuntu0.1, 4.0.0-1ubuntu0.1~esm1, 4.0.1-1ubuntu0.1, 5.0.0-1ubuntu0.1
python-Flask-Cors - update to 4.0.0-2
python-Flask-Cors-help - update to 4.0.0-2
python3-Flask-Cors - update to 4.0.0-2
python-flask-cors - update to 4.0.1-1.fc41
IBM Maximo Application Suite - addressed in versions 8.10.16, 8.11.13, 9.0.1

External References

Related Security Bulletins