Information disclosure in Flask-CORS - CVE-2024-6221

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU96730

Information disclosure in Flask-CORS - CVE-2024-6221

Published: September 3, 2024


Vulnerability identifier: #VU96730
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-6221
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application within the "Access-Control-Allow-Private-Network" CORS header. A remote attacker can gain unauthorized access to sensitive information on the system.


Affected software

Flask-CORS
IBM Cloud Pak for Security
IBM Cloud Pak for Data System
Qradar Advisor
IBM Maximo Application Suite
watsonx.data
Ubuntu
openEuler
IBM Application Suite - IBM Asset Data Dictionary Component
Truststore Manager
QRadar Suite
python-flask-cors (Ubuntu package)
python-Flask-Cors-help
python3-Flask-Cors
python-Flask-Cors

How to mitigate CVE-2024-6221

Install updates from vendor's website.

Flask-CORS - update to 4.0.2
IBM Cloud Pak for Data System - update to 2.0.2.1.IF2
watsonx.data - update to 2.3.1
IBM Application Suite - IBM Asset Data Dictionary Component - update to 1.1.13
Truststore Manager - update to 1.6.0
QRadar Suite - update to 1.10.26.0
Qradar Advisor - update to 2.6.6
python-flask-cors (Ubuntu package) - addressed in versions 3.0.8-2ubuntu0.1+esm1, 3.0.9-2ubuntu0.1, 4.0.0-1ubuntu0.1~esm1, 4.0.1-1ubuntu0.1, 5.0.0-1ubuntu0.1
python-Flask-Cors-help - update to 5.0.0-1
python3-Flask-Cors - update to 5.0.0-1
python-Flask-Cors - update to 5.0.0-1
IBM Maximo Application Suite - addressed in versions 8.10.19, 8.11.16, 9.0.4

External References

Related Security Bulletins