Lucene search

Veracode Vulnerability DatabaseVERACODE:47386

HistoryJun 06, 2024 - 6:40 a.m.

Command Injection

2024-06-0606:40:13

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

vulnerability improper neutralization special elements unauthorized modification exfiltration secrets

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

6.7 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

gradio is vulnerable to Command Injection. The vulnerability is due to improper neutralization of special elements within the test-functional.yml CI work flow, which results in unauthorized modification of the base repository or exfiltration of the GITHUB_TOKEN, COMMENT_TOKEN, or CHROMATIC_PROJECT_TOKEN' secrets.

CPENameOperatorVersion
gradiole4.28.3
gradiole4.28.3

CPE	Name	Operator	Version
	gradio	le	4.28.3
	gradio	le	4.28.3

References

github.com/advisories/GHSA-r897-wrpm-h4vw

github.com/gradio-app/gradio/commit/a0e70366a8a406fdd80abb21e8c88a3c8e682a2b

huntr.com/bounties/23cb3749-8ae9-4e1a-9023-4a20ca6b675e

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

6.7 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

Related for VERACODE:47386