SB2024101079 - Multiple vulnerabilities in Gradio

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2024101079

SB2024101079 - Multiple vulnerabilities in Gradio

Published: October 10, 2024 Updated: April 28, 2026

Security Bulletin ID SB2024101079
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 75% Low 25%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 vulnerabilities.


1) Information Exposure Through Timing Discrepancy (CVE-ID: CVE-2024-47869)

CWE-ID: CWE-208 - Information Exposure Through Timing Discrepancy

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to gain unauthorized access to the analytics dashboard.

The vulnerability exists due to observable timing discrepancies in hash comparison in the analytics_dashboard function when comparing attacker-supplied keys against the expected hash. A remote attacker can send repeated requests and measure response times to infer the correct hash byte-by-byte to gain unauthorized access to the analytics dashboard.


2) Path traversal (CVE-ID: CVE-2024-47166)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to path traversal in the /custom_component endpoint when processing a manipulated file path in a request. A remote attacker can send a specially crafted request to disclose sensitive information.

The traversal is limited to a single directory level and can expose source code from custom Gradio components.


3) Improper access control (CVE-ID: CVE-2024-47168)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper access control in the /monitoring endpoint when monitoring is expected to be disabled via the enable_monitoring flag. A remote attacker can send a direct request to the endpoint to disclose sensitive information.

Sensitive application analytics may be exposed even when monitoring is configured as disabled.


4) Improper access control (CVE-ID: CVE-2024-47084)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to make unauthorized requests and disclose sensitive information.

The vulnerability exists due to improper access control in CustomCORSMiddleware when handling cross-origin requests with a cookie present. A remote user can host a malicious website to make unauthorized requests and disclose sensitive information.

This impacts locally deployed instances that use basic authentication, and exploitation requires the victim to visit a malicious website while logged in.


Remediation

Install update from vendor's website.

References