En bref
- CVE-2024-47870 est une vulnérabilité ÉLEVÉE (CVSS 8.1) touchant gradio, gradio (gradio project).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.37%, plus élevée que 31.2% des vulnérabilités.
- Correctif : mettre à jour vers 5.0.0 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| gradio PyPI | < 5.0.0
| 5.0.0
|
| gradio | < 5.0.0
| 5.0.0
|
Description
Impact
What kind of vulnerability is it? Who is impacted?
This vulnerability involves a race condition in the update_root_in_config function, allowing an attacker to modify the root URL used by the Gradio frontend to communicate with the backend. By exploiting this flaw, an attacker can redirect user traffic to a malicious server. This could lead to the interception of sensitive data such as authentication credentials or uploaded files. This impacts all users who connect to a Gradio server, especially those exposed to the internet, where malicious actors could exploit this race condition.
Patches
Yes, please upgrade to gradio>=5 to address this issue.
NVD description
Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves a **race condition** in the `update_root_in_config` function, allowing an attacker to modify the `root` URL used by the Gradio frontend to communicate with the backend. By exploiting this flaw, an attacker can redirect user traffic to a malicious server. This could lead to the interception of sensitive data such as authentication credentials or uploaded files. This impacts all users who connect to a Gradio server, especially those exposed to the internet, where malicious actors could exploit this race condition. Users are advised to upgrade to `gradio>=5` to address this issue. There are no known workarounds for this issue.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free