PYSEC-2023-249

    Dashboard / Vulnerabilities / PYSEC-2023-249

    PYSEC-2023-249

    Published: 22 Dec 2023Last Modified: 17 Jan 2024

    Summary:

    Details: Gradio is an open-source Python package that allows you to quickly build a demo or web application for your machine learning model, API, or any arbitary Python function. Versions of `gradio` prior to 4.11.0 contained a vulnerability in the `/file` route which made them susceptible to file traversal attacks in which an attacker could access arbitrary files on a machine running a Gradio app with a public URL (e.g. if the demo was created with `share=True`, or on Hugging Face Spaces) if they knew the path of files to look for. This issue has been patched in version 4.11.0.

    References: https://github.com/gradio-app/gradio/security/advisories/GHSA-6qm2-wpxq-7qh2, https://github.com/gradio-app/gradio/commit/1b9d4234d6c25ef250d882c7b90e1f4039ed2d76, https://github.com/gradio-app/gradio/commit/7ba8c5da45b004edd12c0460be9222f5b5f5f055

    Affected packages

    Package

    Name: gradio

    Purl: pkg:pypi/gradio

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -1b9d4234d6c25ef250d882c7b90e1f4039ed2d76

    Affected versions

    0.1.0
    0.1.1
    0.1.2
    0.1.3
    0.1.4
    0.1.5
    0.1.6
    0.1.7
    0.1.8
    0.1.9

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    PYSEC-2023-249 | CVE-DB