CVE-2024-1183
SSRF Vulnerability in gradio-app/gradio
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
An SSRF (Server-Side Request Forgery) vulnerability exists in the gradio-app/gradio repository, allowing attackers to scan and identify open ports within an internal network. By manipulating the 'file' parameter in a GET request, an attacker can discern the status of internal ports based on the presence of a 'Location' header or a 'File not allowed' error in the response.
Existe una vulnerabilidad SSRF (Server-Side Request Forgery) en el repositorio gradio-app/gradio, que permite a los atacantes escanear e identificar puertos abiertos dentro de una red interna. Al manipular el parámetro "archivo" en una solicitud GET, un atacante puede discernir el estado de los puertos internos en función de la presencia de un encabezado "Ubicación" o un error "Archivo no permitido" en la respuesta.
CVSS Scores
SSVC
- Decision:Track*
Timeline
- 2024-02-02 CVE Reserved
- 2024-04-16 CVE Published
- 2024-08-01 CVE Updated
- 2025-04-15 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
CAPEC
References (2)
| URL | Tag | Source |
|---|---|---|
| https://github.com/gradio-app/gradio/commit/2ad3d9e7ec6c8eeea59774265b44f11df7394bb4 | ||
| https://huntr.com/bounties/103434f9-87d2-42ea-9907-194a3c25007c |
|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Gradio Project Search vendor "Gradio Project" | Gradio Search vendor "Gradio Project" for product "Gradio" | * | - |
Affected
| ||||||