The zanllp sd-webui-infinite-image-browsing (aka Infinite Image Browsing) extension before 977815a for stable-diffusion-webui (aka Stable Diffusion web UI), if Gradio authentication is enabled without secret key configuration, allows remote attackers to read any local file via /file?path= in the URL, as demonstrated by reading /proc/self/environ to discover credentials.
References
| Link | Resource |
|---|---|
| https://github.com/zanllp/sd-webui-infinite-image-browsing/issues/387 | Issue Tracking Vendor Advisory |
| https://github.com/zanllp/sd-webui-infinite-image-browsing/pull/368/commits/977815a2b28ad953c10ef0114c365f698c4b8f19 | Patch |
Configurations
Configuration 1 (hide)
|
History
12 Sep 2024, 18:35
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-200 |
30 Oct 2023, 19:09
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://github.com/zanllp/sd-webui-infinite-image-browsing/pull/368/commits/977815a2b28ad953c10ef0114c365f698c4b8f19 - Patch | |
| References | (MISC) https://github.com/zanllp/sd-webui-infinite-image-browsing/issues/387 - Issue Tracking, Vendor Advisory | |
| First Time |
Zanllp
Zanllp stable Diffusion Webui Infinite Image Browsing |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| CWE | NVD-CWE-Other | |
| CPE | cpe:2.3:a:zanllp:stable_diffusion_webui_infinite_image_browsing:*:*:*:*:*:*:*:* |
22 Oct 2023, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-10-22 22:15
Updated : 2024-09-12 18:35
NVD link : CVE-2023-46315
Mitre link : CVE-2023-46315
CVE.ORG link : CVE-2023-46315
JSON object : View
Products Affected
zanllp
- stable_diffusion_webui_infinite_image_browsing
CWE