Lucene search

K
githubGitHub Advisory DatabaseGHSA-G6C9-F4XM-9J4X
HistoryJun 22, 2024 - 6:30 a.m.

Open redirect in gradio

2024-06-2206:30:37
CWE-601
GitHub Advisory Database
github.com
12
open redirect
vulnerability
gradio
latest version
phishing
cross-site scripting
server-side request forgery
improper validation
crafted url
user input

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

AI Score

6.5

Confidence

High

An open redirect vulnerability exists in the gradio-app/gradio, affecting the latest version. The vulnerability allows an attacker to redirect users to arbitrary websites, which can be exploited for phishing attacks, Cross-site Scripting (XSS), Server-Side Request Forgery (SSRF), amongst others. This issue is due to improper validation of user-supplied input in the handling of URLs. Attackers can exploit this vulnerability by crafting a malicious URL that, when processed by the application, redirects the user to an attacker-controlled web page.

Affected configurations

Vulners
Node
gradio_projectgradioRange4.36.1python
VendorProductVersionCPE
gradio_projectgradio*cpe:2.3:a:gradio_project:gradio:*:*:*:*:*:python:*:*

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

AI Score

6.5

Confidence

High

Related for GHSA-G6C9-F4XM-9J4X