CVE-2023-34239

Gradio is an open-source Python library that is used to build machine learning and data science. Due to a lack of path filtering Gradio does not properly restrict file access to users. Additionally Gradio does not properly restrict the what URLs are proxied. These issues have been addressed in version 3.34.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/gradio-app/gradio/pull/4370	Patch
https://github.com/gradio-app/gradio/pull/4406	Patch
https://github.com/gradio-app/gradio/security/advisories/GHSA-3qqg-pgqq-3695	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:gradio_project:gradio:*:*:*:*:*:python:*:*

History

21 Jun 2023, 01:48

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 9.1
CPE		cpe:2.3:a:gradio_project:gradio::::::python::*
CWE	~~CWE-20~~	NVD-CWE-noinfo
First Time		Gradio Project Gradio Project gradio
References	~~(MISC) https://github.com/gradio-app/gradio/pull/4370 -~~	(MISC) https://github.com/gradio-app/gradio/pull/4370 - Patch
References	~~(MISC) https://github.com/gradio-app/gradio/pull/4406 -~~	(MISC) https://github.com/gradio-app/gradio/pull/4406 - Patch
References	~~(MISC) https://github.com/gradio-app/gradio/security/advisories/GHSA-3qqg-pgqq-3695 -~~	(MISC) https://github.com/gradio-app/gradio/security/advisories/GHSA-3qqg-pgqq-3695 - Vendor Advisory

08 Jun 2023, 02:44

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-06-08 00:15

Updated : 2024-02-28 20:13

NVD link : CVE-2023-34239

Mitre link : CVE-2023-34239

CVE.ORG link : CVE-2023-34239

JSON object : View

Products Affected

gradio_project

gradio

CWE

NVD-CWE-noinfo CWE-20

Improper Input Validation

{"id": "CVE-2023-34239", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 3.9}]}, "published": "2023-06-08T00:15:09.997", "references": [{"url": "https://github.com/gradio-app/gradio/pull/4370", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/gradio-app/gradio/pull/4406", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/gradio-app/gradio/security/advisories/GHSA-3qqg-pgqq-3695", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}, {"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "Gradio is an open-source Python library that is used to build machine learning and data science. Due to a lack of path filtering Gradio does not properly restrict file access to users. Additionally Gradio does not properly restrict the what URLs are proxied. These issues have been addressed in version 3.34.0. Users are advised to upgrade. There are no known workarounds for this vulnerability."}], "lastModified": "2023-06-21T01:48:49.047", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gradio_project:gradio:*:*:*:*:*:python:*:*", "vulnerable": true, "matchCriteriaId": "12604F63-8ED5-4810-98D1-F64E4787CF9E", "versionEndExcluding": "3.34.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}