Описание
An issue was discovered in Flask-CORS (aka CORS Middleware for Flask) before 3.0.9. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format.
| Релиз | Статус | Примечание |
|---|---|---|
| bionic | DNE | |
| devel | not-affected | 3.0.9-2 |
| esm-apps/focal | released | 3.0.8-2ubuntu0.1 |
| esm-apps/jammy | not-affected | 3.0.9-2 |
| esm-infra-legacy/trusty | DNE | |
| focal | released | 3.0.8-2ubuntu0.1 |
| groovy | ignored | end of life |
| hirsute | not-affected | 3.0.9-2 |
| impish | not-affected | 3.0.9-2 |
| jammy | not-affected | 3.0.9-2 |
Показывать по
EPSS
5 Medium
CVSS2
7.5 High
CVSS3
Связанные уязвимости
An issue was discovered in Flask-CORS (aka CORS Middleware for Flask) before 3.0.9. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format.
An issue was discovered in Flask-CORS (aka CORS Middleware for Flask) before 3.0.9. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format.
An issue was discovered in Flask-CORS (aka CORS Middleware for Flask) ...
EPSS
5 Medium
CVSS2
7.5 High
CVSS3