Vulnerability Description
An issue was discovered in Flask-CORS (aka CORS Middleware for Flask) before 3.0.9. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Flask-Cors Project | Flask-Cors | < 3.0.9 |
| Debian | Debian Linux | 10.0 |
| Opensuse | Backports Sle | 15.0 |
| Opensuse | Leap | 15.1 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00028.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00032.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00039.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00048.htmlMailing ListThird Party Advisory
- https://github.com/corydolphin/flask-cors/releases/tag/3.0.9Third Party Advisory
- https://www.debian.org/security/2020/dsa-4775Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00028.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00032.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00039.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00048.htmlMailing ListThird Party Advisory
- https://github.com/corydolphin/flask-cors/releases/tag/3.0.9Third Party Advisory
- https://www.debian.org/security/2020/dsa-4775Third Party Advisory
FAQ
What is CVE-2020-25032?
CVE-2020-25032 is a vulnerability with a CVSS score of 7.5 (HIGH). An issue was discovered in Flask-CORS (aka CORS Middleware for Flask) before 3.0.9. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnam...
How severe is CVE-2020-25032?
CVE-2020-25032 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-25032?
Check the references section above for vendor advisories and patch information. Affected products include: Flask-Cors Project Flask-Cors, Debian Debian Linux, Opensuse Backports Sle, Opensuse Leap.