PT-2024-18217 · Pypi+4 · Flask-Cors+4

Published 2024-04-19 · Updated 2025-11-13 · CVE-2024-1681

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions corydolphin/flask-cors (affected versions not specified)

Description The issue is due to improper output neutralization for logs, allowing log injection when the log level is set to debug. An attacker can inject fake log entries into the log file by sending a specially crafted GET request containing a CRLF sequence in the request path. This allows attackers to corrupt log files, potentially covering tracks of other attacks, confusing log post-processing tools, and forging log entries.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Weakness Enumeration

CWE-117

Related Identifiers

BDU:2025-11598

CVE-2024-1681

DLA-4197-1

GHSA-84PR-M4JR-85G5

GHSA-PP84-V3MW-GG4W

MGASA-2025-0286

OESA-2024-1713

OPENSUSE-SU-2024:14293-1

PYSEC-2024-271

USN-7612-1

Affected Products

Debian

Linuxmint

Red Os

Ubuntu

Flask-Cors

References · 41

• 🔥 https://huntr.com/bounties/25a7a0ba-9fa2-4777-acb6-03e5539bb644 · Exploit
• https://security-tracker.debian.org/tracker/CVE-2024-1681 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-6839 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2025-0286 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-1681 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-1681 · Security Note
• https://osv.dev/vulnerability/PYSEC-2024-271 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14293-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-1681 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7612-1 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-4197-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-1681 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-84pr-m4jr-85g5 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-1681 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2024-1713 · Vendor Advisory