En bref
- CVE-2024-39903 est une vulnérabilité ÉLEVÉE (CVSS 7.5) touchant solara, solara (widgetti).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 2.9%, plus élevée que 87.0% des vulnérabilités.
- Correctif : mettre à jour vers 1.35.1 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| solara PyPI | < 1.35.1
| 1.35.1
|
| solara | < 1.35.1
| 1.35.1
|
Description
A Local File Inclusion (LFI) vulnerability was identified in widgetti/solara, in version <1.35.1, which was fixed in version 1.35.1. This vulnerability arises from the application's failure to properly validate URI fragments for directory traversal sequences such as '../' when serving static files. An attacker can exploit this flaw by manipulating the fragment part of the URI to read arbitrary files on the local file system.
References
NVD description
Solara is a pure Python, React-style framework for scaling Jupyter and web apps. A Local File Inclusion (LFI) vulnerability was identified in widgetti/solara, in version <1.35.1, which was fixed in version 1.35.1. This vulnerability arises from the application's failure to properly validate URI fragments for directory traversal sequences such as '../' when serving static files. An attacker can exploit this flaw by manipulating the fragment part of the URI to read arbitrary files on the local file system.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free