CVE-2020-25032

An issue was discovered in Flask-CORS (aka CORS Middleware for Flask) before 3.0.9

published August 31, 2020

CVSS
—
EPSS
4%
Percentile
90.5
In the wild
Unconfirmed
What it is

An issue was discovered in Flask-CORS (aka CORS Middleware for Flask) before 3.0.9. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.04017 · 90.5th percentile
Published
2020-08-31T03:57Z
EPSS history
Timeline
  • 31 AUG 03:57Z
    An issue was discovered in Flask-CORS (aka CORS Middleware for Flask) before 3.0.9
    cvelistv5