Lucene search

GitHub_MCVE-2023-34239

HistoryJun 08, 2023 - 12:15 a.m.

CVE-2023-34239

2023-06-0800:15:09

CWE-20

GitHub_M

web.nvd.nist.gov

gradio

python

library

security

vulnerability

cve-2023-34239

file access

url proxying

upgrade

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

AI Score

9.2

Confidence

High

EPSS

0.001

Percentile

51.1%

JSON

Gradio is an open-source Python library that is used to build machine learning and data science. Due to a lack of path filtering Gradio does not properly restrict file access to users. Additionally Gradio does not properly restrict the what URLs are proxied. These issues have been addressed in version 3.34.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected configurations

Nvd

Vulners

Node

gradio_projectgradioRange<3.34.0python

VendorProductVersionCPE
gradio_projectgradio*cpe:2.3:a:gradio_project:gradio:*:*:*:*:*:python:*:*

Vendor	Product	Version	CPE
gradio_project	gradio	*	cpe:2.3:a:gradio_project:gradio::::::python::*

CNA Affected

[
  {
    "vendor": "gradio-app",
    "product": "gradio",
    "versions": [
      {
        "version": "< 3.34.0",
        "status": "affected"
      }
    ]
  }
]

References

github.com/gradio-app/gradio/pull/4370

github.com/gradio-app/gradio/pull/4406

github.com/gradio-app/gradio/security/advisories/GHSA-3qqg-pgqq-3695

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

AI Score

9.2

Confidence

High

EPSS

0.001

Percentile

51.1%

JSON

Related for CVE-2023-34239