CVE-2024-42474 Streamlit Path Traversal Security Vulnerability on Windows

2024-08-1217:01:44

CWE-22

GitHub_M

www.cve.org

streamlit

path traversal

security vulnerability

windows

static file sharing

snowflake

password hash

patched

jul 25 2024

version 1.37.0

data oriented application

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N

EPSS

0.001

Percentile

19.7%

JSON

Streamlit is a data oriented application development framework for python. Snowflake Streamlit open source addressed a security vulnerability via the static file sharing feature. Users of hosted Streamlit app(s) on Windows were vulnerable to a path traversal vulnerability when the static file sharing feature is enabled. An attacker could utilize the vulnerability to leak the password hash of the Windows user running Streamlit. The vulnerability was patched on Jul 25, 2024, as part of Streamlit open source version 1.37.0. The vulnerability only affects Windows.

CNA Affected

[
  {
    "vendor": "streamlit",
    "product": "streamlit",
    "versions": [
      {
        "version": "< 1.37.0",
        "status": "affected"
      }
    ]
  }
]