CVE-2024-6221: 
Python vulnerability analysis and mitigation

A vulnerability has been identified in corydolphin/flask-cors version 4.0.1 where the Access-Control-Allow-Private-Network CORS header is set to true by default, without any configuration option. This security flaw was assigned CVE-2024-6221 and was published on August 18, 2024. The vulnerability received a CVSS v3.1 base score of 7.5 (HIGH) from NIST and 6.5 (MEDIUM) from huntr.dev (NVD Database).

The vulnerability stems from the default configuration of the Access-Control-Allow-Private-Network CORS header being set to true without providing users the ability to configure this setting. The severity assessment varies between sources, with NIST assigning a CVSS v3.1 vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5 HIGH), while huntr.dev rates it as CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N (6.5 MEDIUM). The vulnerability is classified under CWE-284 (Improper Access Control) (NVD Database).

The vulnerability can expose private network resources to unauthorized external access. This exposure could potentially lead to significant security risks including data breaches, unauthorized access to sensitive information, and potential network intrusions (NVD Database).

The vulnerability is remotely exploitable (Network attack vector) with low attack complexity and requires no privileges or user interaction according to the NIST assessment (NVD Database).