CVE-2024-1183

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-1183", "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "state": "PUBLISHED", "assignerShortName": "@huntr_ai", "dateReserved": "2024-02-02T00:58:50.748Z", "datePublished": "2024-04-16T00:00:14.458Z", "dateUpdated": "2024-08-01T18:33:24.939Z"}, "containers": {"cna": {"title": "SSRF Vulnerability in gradio-app/gradio", "providerMetadata": {"orgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "shortName": "@huntr_ai", "dateUpdated": "2024-04-16T11:10:55.212Z"}, "descriptions": [{"lang": "en", "value": "An SSRF (Server-Side Request Forgery) vulnerability exists in the gradio-app/gradio repository, allowing attackers to scan and identify open ports within an internal network. By manipulating the 'file' parameter in a GET request, an attacker can discern the status of internal ports based on the presence of a 'Location' header or a 'File not allowed' error in the response."}], "affected": [{"vendor": "gradio-app", "product": "gradio-app/gradio", "versions": [{"version": "unspecified", "lessThan": "4.11", "status": "affected", "versionType": "custom"}]}], "references": [{"url": "https://huntr.com/bounties/103434f9-87d2-42ea-9907-194a3c25007c"}, {"url": "https://github.com/gradio-app/gradio/commit/2ad3d9e7ec6c8eeea59774265b44f11df7394bb4"}], "metrics": [{"cvssV3_0": {"version": "3.0", "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM"}}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-601 URL Redirection to Untrusted Site", "cweId": "CWE-601"}]}], "source": {"advisory": "103434f9-87d2-42ea-9907-194a3c25007c", "discovery": "EXTERNAL"}}, "adp": [{"affected": [{"vendor": "gradio_project", "product": "gradio", "cpes": ["cpe:2.3:a:gradio_project:gradio:-:*:*:*:*:python:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "4.11", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-06-20T18:25:36.964600Z", "id": "CVE-2024-1183", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-20T18:25:39.204Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T18:33:24.939Z"}, "title": "CVE Program Container", "references": [{"url": "https://huntr.com/bounties/103434f9-87d2-42ea-9907-194a3c25007c", "tags": ["x_transferred"]}, {"url": "https://github.com/gradio-app/gradio/commit/2ad3d9e7ec6c8eeea59774265b44f11df7394bb4", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://huntr.com/bounties/103434f9-87d2-42ea-9907-194a3c25007c", "tags": ["x_transferred"]}, {"url": "https://github.com/gradio-app/gradio/commit/2ad3d9e7ec6c8eeea59774265b44f11df7394bb4", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T18:33:24.939Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-1183", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-06-20T18:25:36.964600Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:gradio_project:gradio:-:*:*:*:*:python:*:*"], "vendor": "gradio_project", "product": "gradio", "versions": [{"status": "affected", "version": "0", "lessThan": "4.11", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-20T18:25:26.513Z"}}], "cna": {"title": "SSRF Vulnerability in gradio-app/gradio", "source": {"advisory": "103434f9-87d2-42ea-9907-194a3c25007c", "discovery": "EXTERNAL"}, "metrics": [{"cvssV3_0": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "gradio-app", "product": "gradio-app/gradio", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "4.11", "versionType": "custom"}]}], "references": [{"url": "https://huntr.com/bounties/103434f9-87d2-42ea-9907-194a3c25007c"}, {"url": "https://github.com/gradio-app/gradio/commit/2ad3d9e7ec6c8eeea59774265b44f11df7394bb4"}], "descriptions": [{"lang": "en", "value": "An SSRF (Server-Side Request Forgery) vulnerability exists in the gradio-app/gradio repository, allowing attackers to scan and identify open ports within an internal network. By manipulating the 'file' parameter in a GET request, an attacker can discern the status of internal ports based on the presence of a 'Location' header or a 'File not allowed' error in the response."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-601", "description": "CWE-601 URL Redirection to Untrusted Site"}]}], "providerMetadata": {"orgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "shortName": "@huntr_ai", "dateUpdated": "2024-04-16T11:10:55.212Z"}}}, "cveMetadata": {"cveId": "CVE-2024-1183", "state": "PUBLISHED", "dateUpdated": "2024-08-01T18:33:24.939Z", "dateReserved": "2024-02-02T00:58:50.748Z", "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "datePublished": "2024-04-16T00:00:14.458Z", "assignerShortName": "@huntr_ai"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "gradio-app/gradio", "vendor": "gradio-app", "versions": [{"lessThan": "4.11", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "source": "security@huntr.dev"}, {"affectedData": [{"cpes": ["cpe:2.3:a:gradio_project:gradio:-:*:*:*:*:python:*:*"], "defaultStatus": "unknown", "product": "gradio", "vendor": "gradio_project", "versions": [{"lessThan": "4.11", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:gradio_project:gradio:*:*:*:*:*:python:*:*", "matchCriteriaId": "ECC66B85-077C-41FE-9001-B7471C289D3F", "versionEndExcluding": "4.11.0", "versionStartIncluding": "3.41.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An SSRF (Server-Side Request Forgery) vulnerability exists in the gradio-app/gradio repository, allowing attackers to scan and identify open ports within an internal network. By manipulating the 'file' parameter in a GET request, an attacker can discern the status of internal ports based on the presence of a 'Location' header or a 'File not allowed' error in the response."}, {"lang": "es", "value": "Existe una vulnerabilidad SSRF (Server-Side Request Forgery) en el repositorio gradio-app/gradio, que permite a los atacantes escanear e identificar puertos abiertos dentro de una red interna. Al manipular el par\u00e1metro \"archivo\" en una solicitud GET, un atacante puede discernir el estado de los puertos internos en funci\u00f3n de la presencia de un encabezado \"Ubicaci\u00f3n\" o un error \"Archivo no permitido\" en la respuesta."}], "id": "CVE-2024-1183", "lastModified": "2026-06-17T07:03:39.380", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security@huntr.dev", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-1183", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-06-20T18:25:36.964600Z", "version": "2.0.3"}}]}, "published": "2024-04-16T00:15:07.990", "references": [{"source": "security@huntr.dev", "tags": ["Patch"], "url": "https://github.com/gradio-app/gradio/commit/2ad3d9e7ec6c8eeea59774265b44f11df7394bb4"}, {"source": "security@huntr.dev", "tags": ["Exploit", "Third Party Advisory"], "url": "https://huntr.com/bounties/103434f9-87d2-42ea-9907-194a3c25007c"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/gradio-app/gradio/commit/2ad3d9e7ec6c8eeea59774265b44f11df7394bb4"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://huntr.com/bounties/103434f9-87d2-42ea-9907-194a3c25007c"}], "sourceIdentifier": "security@huntr.dev", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-601"}], "source": "security@huntr.dev", "type": "Secondary"}]}

{}

{}