CVE-2024-6839

CVE-2024-6839 affects corydolphin/flask-cors version 4.0.1, stemming from an improper regex path matching vulnerability where longer, less specific regex patterns are prioritized over more specific ones. This flaw can lead to less restrictive Cross-Origin Resource Sharing (CORS) policies being applied to sensitive endpoints, potentially allowing unauthorized cross-origin access to confidential data or functionality. With a CVSS score of 5.3 (Medium), this vulnerability has a network attack vector and low attack complexity, but its impact is limited to confidentiality. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.