Open mend-bolt-for-github[bot] opened 2 years ago
A Flask extension adding a decorator for CORS support
Library home page: https://files.pythonhosted.org/packages/78/38/e68b11daa5d613e3a91e4bf3da76c94ac9ee0d9cd515af9c1ab80d36f709/Flask_Cors-3.0.8-py2.py3-none-any.whl
Path to dependency file: /tmp/ws-scm/Container-Security-With-JenkinsCI/requirements.txt
Path to vulnerable library: /Container-Security-With-JenkinsCI/requirements.txt
Dependency Hierarchy: - :x: **Flask_Cors-3.0.8-py2.py3-none-any.whl** (Vulnerable Library)
Found in base branch: master
An issue was discovered in Flask-CORS (aka CORS Middleware for Flask) before 3.0.9. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format.
Publish Date: 2020-08-31
URL: CVE-2020-25032
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None
Type: Upgrade version
Release Date: 2020-08-31
Fix Resolution: 3.0.9
Step up your Open Source Security Game with Mend here
CVE-2020-25032 - High Severity Vulnerability
A Flask extension adding a decorator for CORS support
Library home page: https://files.pythonhosted.org/packages/78/38/e68b11daa5d613e3a91e4bf3da76c94ac9ee0d9cd515af9c1ab80d36f709/Flask_Cors-3.0.8-py2.py3-none-any.whl
Path to dependency file: /tmp/ws-scm/Container-Security-With-JenkinsCI/requirements.txt
Path to vulnerable library: /Container-Security-With-JenkinsCI/requirements.txt
Dependency Hierarchy: - :x: **Flask_Cors-3.0.8-py2.py3-none-any.whl** (Vulnerable Library)
Found in base branch: master
An issue was discovered in Flask-CORS (aka CORS Middleware for Flask) before 3.0.9. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format.
Publish Date: 2020-08-31
URL: CVE-2020-25032
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None
For more information on CVSS3 Scores, click here.Type: Upgrade version
Release Date: 2020-08-31
Fix Resolution: 3.0.9
Step up your Open Source Security Game with Mend here