Kurz gesagt
- CVE-2024-47870 ist eine Schwachstelle (HOCH (CVSS 8.1)) in gradio, gradio (gradio project).
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.37%, höher als bei 31.2% aller Schwachstellen.
- Abhilfe: auf 5.0.0 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| gradio PyPI | < 5.0.0
| 5.0.0
|
| gradio | < 5.0.0
| 5.0.0
|
Description
Impact
What kind of vulnerability is it? Who is impacted?
This vulnerability involves a race condition in the update_root_in_config function, allowing an attacker to modify the root URL used by the Gradio frontend to communicate with the backend. By exploiting this flaw, an attacker can redirect user traffic to a malicious server. This could lead to the interception of sensitive data such as authentication credentials or uploaded files. This impacts all users who connect to a Gradio server, especially those exposed to the internet, where malicious actors could exploit this race condition.
Patches
Yes, please upgrade to gradio>=5 to address this issue.
NVD description
Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves a **race condition** in the `update_root_in_config` function, allowing an attacker to modify the `root` URL used by the Gradio frontend to communicate with the backend. By exploiting this flaw, an attacker can redirect user traffic to a malicious server. This could lead to the interception of sensitive data such as authentication credentials or uploaded files. This impacts all users who connect to a Gradio server, especially those exposed to the internet, where malicious actors could exploit this race condition. Users are advised to upgrade to `gradio>=5` to address this issue. There are no known workarounds for this issue.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free