CVE-2024-39903

{"id": "CVE-2024-39903", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.7, "exploitabilityScore": 3.9}]}, "published": "2024-07-12T15:15:11.177", "references": [{"url": "https://github.com/widgetti/solara/commit/df2fd66a7f4e8ffd36e8678697a8a4f76760dc54", "source": "security-advisories@github.com"}, {"url": "https://github.com/widgetti/solara/security/advisories/GHSA-9794-pc4r-438w", "source": "security-advisories@github.com"}, {"url": "https://github.com/widgetti/solara/commit/df2fd66a7f4e8ffd36e8678697a8a4f76760dc54", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/widgetti/solara/security/advisories/GHSA-9794-pc4r-438w", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Solara is a pure Python, React-style framework for scaling Jupyter and web apps. A Local File Inclusion (LFI) vulnerability was identified in widgetti/solara, in version <1.35.1, which was fixed in version 1.35.1. This vulnerability arises from the application's failure to properly validate URI fragments for directory traversal sequences such as '../' when serving static files. An attacker can exploit this flaw by manipulating the fragment part of the URI to read arbitrary files on the local file system."}, {"lang": "es", "value": "Solara es un framework puro de Python, estilo React, para escalar Jupyter y aplicaciones web. Se identific\u00f3 una vulnerabilidad de inclusi\u00f3n de archivos locales (LFI) en widgetti/solara, en la versi\u00f3n &lt;1.35.1, que se solucion\u00f3 en la versi\u00f3n 1.35.1. Esta vulnerabilidad surge de la falla de la aplicaci\u00f3n al validar correctamente los fragmentos de URI para secuencias directory traversal como '../' al servir archivos est\u00e1ticos. Un atacante puede aprovechar esta falla manipulando la parte del fragmento del URI para leer archivos arbitrarios en el sistema de archivos local."}], "lastModified": "2024-11-21T09:28:32.080", "sourceIdentifier": "security-advisories@github.com"}