CVE-2024-1681 - CVE House
Back to Database
Status published Medium CVE-2024-1681

Log Injection Vulnerability in corydolphin/flask-cors

Vulnerability Description

corydolphin/flask-cors is vulnerable to log injection when the log level is set to debug. An attacker can inject fake log entries into the log file by sending a specially crafted GET request containing a CRLF sequence in the request path. This vulnerability allows attackers to corrupt log files, potentially covering tracks of other attacks, confusing log post-processing tools, and forging log entries. The issue is due to improper output neutralization for logs.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-1681

Credits & Attribution

No credits recorded in the NVD database.

References

More from corydolphin

View All →
CVE-2024-6866
Case-Insensitive Path Matching in corydolphin/flask-cors
Medium 5.3
CVE-2024-6844
Inconsistent CORS Matching Due to Handling of '+' in URL Path in corydolphin/flask-cors
Medium 5.3
CVE-2024-6839
Improper Regex Path Matching in corydolphin/flask-cors
Medium 4.3
CVE-2024-6221
Improper Access Control in corydolphin/flask-cors
Medium 6.5

Affected Vendor

corydolphin

View all reports →

Affected Software

corydolphin/flask-cors
Vulnerable Versions:
unspecified

Timeline

Official Publish: April 19th, 2024
Last Modified: November 3rd, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weaknesses (CWE)

CWE-117

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.