Kurz gesagt
- CVE-2024-39903 ist eine Schwachstelle (HOCH (CVSS 7.5)) in solara, solara (widgetti).
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 2.9%, höher als bei 87.0% aller Schwachstellen.
- Abhilfe: auf 1.35.1 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| solara PyPI | < 1.35.1
| 1.35.1
|
| solara | < 1.35.1
| 1.35.1
|
Description
A Local File Inclusion (LFI) vulnerability was identified in widgetti/solara, in version <1.35.1, which was fixed in version 1.35.1. This vulnerability arises from the application's failure to properly validate URI fragments for directory traversal sequences such as '../' when serving static files. An attacker can exploit this flaw by manipulating the fragment part of the URI to read arbitrary files on the local file system.
References
NVD description
Solara is a pure Python, React-style framework for scaling Jupyter and web apps. A Local File Inclusion (LFI) vulnerability was identified in widgetti/solara, in version <1.35.1, which was fixed in version 1.35.1. This vulnerability arises from the application's failure to properly validate URI fragments for directory traversal sequences such as '../' when serving static files. An attacker can exploit this flaw by manipulating the fragment part of the URI to read arbitrary files on the local file system.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free