Lucene search

GitHub_MCVELIST:CVE-2023-34239

HistoryJun 07, 2023 - 11:20 p.m.

CVE-2023-34239 Unfiltered paths in gradio

2023-06-0723:20:06

CWE-20

GitHub_M

www.cve.org

gradio

python

machine learning

data science

security vulnerability

file access

url proxying

update required

CVSS3

7.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

AI Score

9.5

Confidence

High

EPSS

0.001

Percentile

51.1%

JSON

Gradio is an open-source Python library that is used to build machine learning and data science. Due to a lack of path filtering Gradio does not properly restrict file access to users. Additionally Gradio does not properly restrict the what URLs are proxied. These issues have been addressed in version 3.34.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CNA Affected

[
  {
    "vendor": "gradio-app",
    "product": "gradio",
    "versions": [
      {
        "version": "< 3.34.0",
        "status": "affected"
      }
    ]
  }
]

References

github.com/gradio-app/gradio/pull/4370

github.com/gradio-app/gradio/pull/4406

github.com/gradio-app/gradio/security/advisories/GHSA-3qqg-pgqq-3695

CVSS3

7.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

AI Score

9.5

Confidence

High

EPSS

0.001

Percentile

51.1%

JSON

Related for CVELIST:CVE-2023-34239