CVE-2024-6844

Summary

CVE-2024-6844 is a vulnerability affecting the Flask-CORS library version 4.0.1 by corydolphin. The issue involves inconsistent CORS (Cross-Origin Resource Sharing) matching due to the way the '+' character in URL paths is handled. The '+' character is converted to a space ' ' during the path normalization process, leading to potential mismatches between endpoints and their CORS settings. This can result in unintended CORS policy application, allowing for unauthorized cross-origin access or the blocking of valid requests, posing both security risks and usability issues.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.