CVE-2024-42474

2024-08-1217:15:17

CWE-22

GitHub_M

web.nvd.nist.gov

snowflake streamlit

path traversal

static file sharing

windows

vulnerability

password hash

patch

version 1.37.0

jul 25 2024

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS

0.001

Percentile

19.7%

JSON

Streamlit is a data oriented application development framework for python. Snowflake Streamlit open source addressed a security vulnerability via the static file sharing feature. Users of hosted Streamlit app(s) on Windows were vulnerable to a path traversal vulnerability when the static file sharing feature is enabled. An attacker could utilize the vulnerability to leak the password hash of the Windows user running Streamlit. The vulnerability was patched on Jul 25, 2024, as part of Streamlit open source version 1.37.0. The vulnerability only affects Windows.

Affected configurations

Nvd

Vulners

Node

snowflakestreamlitRange<1.37.0

AND

microsoftwindowsMatch-

VendorProductVersionCPE
snowflakestreamlit*cpe:2.3:a:snowflake:streamlit:*:*:*:*:*:*:*:*
microsoftwindows-cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
snowflake	streamlit	*	cpe:2.3:a:snowflake:streamlit::::::::
microsoft	windows	-	cpe:2.3:o:microsoft:windows:-:::::::*

CNA Affected

[
  {
    "vendor": "streamlit",
    "product": "streamlit",
    "versions": [
      {
        "version": "< 1.37.0",
        "status": "affected"
      }
    ]
  }
]