CVE-2024-6866
CVSS 3.0 Score 5.3 of 10 (medium)
Details
Published Mar 20, 2025
CWE ID 178
Summary
CVE-2024-6866 is a new vulnerability affecting the corydolphin/flask-cors library version 4.01. The issue stems from the library's use of the `try_match` function, which is intended for host matching but is inadvertently used for path matching. This misconfiguration leads to case-insensitive path matching, despite URL paths being inherently case-sensitive. This vulnerability can result in unauthorized origins gaining access to restricted paths, potentially causing data exposure and leaks.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.