CVE-2024-6839 - CVE House
Back to Database
Status published Medium CVE-2024-6839

Improper Regex Path Matching in corydolphin/flask-cors

Vulnerability Description

corydolphin/flask-cors version 4.0.1 contains an improper regex path matching vulnerability. The plugin prioritizes longer regex patterns over more specific ones when matching paths, which can lead to less restrictive CORS policies being applied to sensitive endpoints. This mismatch in regex pattern priority allows unauthorized cross-origin access to sensitive data or functionality, potentially exposing confidential information and increasing the risk of unauthorized actions by malicious actors.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-6839

Credits & Attribution

No credits recorded in the NVD database.

References

More from corydolphin

View All →
CVE-2024-6866
Case-Insensitive Path Matching in corydolphin/flask-cors
Medium 5.3
CVE-2024-6844
Inconsistent CORS Matching Due to Handling of '+' in URL Path in corydolphin/flask-cors
Medium 5.3
CVE-2024-6221
Improper Access Control in corydolphin/flask-cors
Medium 6.5
CVE-2024-1681
Log Injection Vulnerability in corydolphin/flask-cors
Medium 5.3

Affected Vendor

corydolphin

View all reports →

Affected Software

corydolphin/flask-cors
Vulnerable Versions:
unspecified

Timeline

Official Publish: March 20th, 2025
Last Modified: November 3rd, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Weaknesses (CWE)

CWE-41

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.