PYSEC-2022-248

    Dashboard / Vulnerabilities / PYSEC-2022-248

    PYSEC-2022-248

    Published: 1 Aug 2022Last Modified: 8 Nov 2023

    Summary:

    Details: Streamlit is a data oriented application development framework for python. Users hosting Streamlit app(s) that use custom components are vulnerable to a directory traversal attack that could leak data from their web server file-system such as: server logs, world readable files, and potentially other sensitive information. An attacker can craft a malicious URL with file paths and the streamlit server would process that URL and return the contents of that file or overwrite existing files on the web-server. This issue has been resolved in version 1.11.1. Users are advised to upgrade. There are no known workarounds for this issue.

    References: https://github.com/streamlit/streamlit/security/advisories/GHSA-v4hr-4jpx-56gc, https://github.com/streamlit/streamlit/commit/80d9979d5f4a00217743d607078a1d867fad8acf

    Affected packages

    Package

    Name: streamlit

    Purl: pkg:pypi/streamlit

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -80d9979d5f4a00217743d607078a1d867fad8acf

    Affected versions

    0.63.0
    0.63.1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    PYSEC-2022-248 | CVE-DB