NVD Vulnerability Detail

CVE-2020-25032

Summary	An issue was discovered in Flask-CORS (aka CORS Middleware for Flask) before 3.0.9. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format.
Publication Date	Aug. 31, 2020, 1:15 p.m.
Registration Date	Jan. 26, 2021, 11:55 a.m.
Last Update	Nov. 21, 2024, 2:16 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:flask-cors_project:flask-cors::::::::					3.0.9

Configuration2		or higher	or less	more than	less than
cpe:2.3:o:debian:debian_linux:10.0:::::::*

Configuration3	or higher	or less	more than	less than
cpe:2.3:o:opensuse:leap:15.1:::::::*
cpe:2.3:a:opensuse:backports_sle:15.0:sp1::::::
cpe:2.3:o:opensuse:leap:15.2:::::::*
cpe:2.3:a:opensuse:backports_sle:15.0:sp2::::::

Related information, measures and tools

No	URL	タグ
1	http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00028.html	Mailing List Third Party Advisory
2	http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00028.html	Mailing List Third Party Advisory
3	http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00032.html	Mailing List Third Party Advisory
4	http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00032.html	Mailing List Third Party Advisory
5	http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00039.html	Mailing List Third Party Advisory
6	http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00039.html	Mailing List Third Party Advisory
7	http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00048.html	Mailing List Third Party Advisory
8	http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00048.html	Mailing List Third Party Advisory
9	https://github.com/corydolphin/flask-cors/releases/tag/3.0.9	Third Party Advisory
10	https://github.com/corydolphin/flask-cors/releases/tag/3.0.9	Third Party Advisory
11	https://www.debian.org/security/2020/dsa-4775	Third Party Advisory
12	https://www.debian.org/security/2020/dsa-4775	Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-22	パス・トラバーサル	https://cwe.mitre.org/data/definitions/22.html

JVN Vulnerability Information

Flask-CORS におけるリソースの安全ではないデフォルト値への初期化に関する脆弱性

Title	Flask-CORS におけるリソースの安全ではないデフォルト値への初期化に関する脆弱性
Summary	Flask-CORS (別名 CORS Middleware for Flask) には、リソースの安全ではないデフォルト値への初期化に関する脆弱性が存在します。
Possible impacts	情報を取得される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Aug. 31, 2020, midnight
Registration Date	Jan. 26, 2021, 2:26 p.m.
Last Update	Jan. 26, 2021, 2:26 p.m.

Affected System

flask-cors project

Flask-CORS 3.0.9 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2020-25032	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25032
National Vulnerability Database (NVD)
2	CVE-2020-25032	https://nvd.nist.gov/vuln/detail/CVE-2020-25032

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-1188	https://cwe.mitre.org/data/definitions/1188.html

ベンダー情報

No	Name	URL
GitHub
1	Release 3.0.9	https://github.com/corydolphin/flask-cors/releases/tag/3.0.9

Change Log

No	Changed Details	Date of change
1	[2021年01月26日] 掲載	Jan. 26, 2021, 2:26 p.m.