CVE-2024-51751

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-51751", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-10-31T14:12:45.790Z", "datePublished": "2024-11-06T19:11:38.731Z", "dateUpdated": "2024-11-06T19:58:13.376Z"}, "containers": {"cna": {"title": "Arbitrary file read with File and UploadButton components in Gradio", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/gradio-app/gradio/security/advisories/GHSA-rhm9-gp5p-5248", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/gradio-app/gradio/security/advisories/GHSA-rhm9-gp5p-5248"}], "affected": [{"vendor": "gradio-app", "product": "gradio", "versions": [{"version": ">= 5.0.0, < 5.5.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-11-06T19:11:38.731Z"}, "descriptions": [{"lang": "en", "value": "Gradio is an open-source Python package designed to enable quick builds of a demo or web application. If File or UploadButton components are used as a part of Gradio application to preview file content, an attacker with access to the application might abuse these components to read arbitrary files from the application server. This issue has been addressed in release version 5.5.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability."}], "source": {"advisory": "GHSA-rhm9-gp5p-5248", "discovery": "UNKNOWN"}}, "adp": [{"affected": [{"vendor": "gradio_project", "product": "gradio", "cpes": ["cpe:2.3:a:gradio_project:gradio:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "5.0.0", "status": "affected", "lessThan": "5.5.0", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-11-06T19:54:26.224028Z", "id": "CVE-2024-51751", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-06T19:58:13.376Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-51751", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-11-06T19:54:26.224028Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:gradio_project:gradio:*:*:*:*:*:*:*:*"], "vendor": "gradio_project", "product": "gradio", "versions": [{"status": "affected", "version": "5.0.0", "lessThan": "5.5.0", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-06T19:57:53.458Z"}}], "cna": {"title": "Arbitrary file read with File and UploadButton components in Gradio", "source": {"advisory": "GHSA-rhm9-gp5p-5248", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "gradio-app", "product": "gradio", "versions": [{"status": "affected", "version": ">= 5.0.0, < 5.5.0"}]}], "references": [{"url": "https://github.com/gradio-app/gradio/security/advisories/GHSA-rhm9-gp5p-5248", "name": "https://github.com/gradio-app/gradio/security/advisories/GHSA-rhm9-gp5p-5248", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Gradio is an open-source Python package designed to enable quick builds of a demo or web application. If File or UploadButton components are used as a part of Gradio application to preview file content, an attacker with access to the application might abuse these components to read arbitrary files from the application server. This issue has been addressed in release version 5.5.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-11-06T19:11:38.731Z"}}}, "cveMetadata": {"cveId": "CVE-2024-51751", "state": "PUBLISHED", "dateUpdated": "2024-11-06T19:58:13.376Z", "dateReserved": "2024-10-31T14:12:45.790Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2024-11-06T19:11:38.731Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "gradio", "vendor": "gradio-app", "versions": [{"status": "affected", "version": ">= 5.0.0, < 5.5.0"}]}], "source": "security-advisories@github.com"}, {"affectedData": [{"cpes": ["cpe:2.3:a:gradio_project:gradio:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "gradio", "vendor": "gradio_project", "versions": [{"lessThan": "5.5.0", "status": "affected", "version": "5.0.0", "versionType": "custom"}]}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:gradio_project:gradio:*:*:*:*:*:python:*:*", "matchCriteriaId": "B94EAA72-1E17-4B5F-9EA6-D529D6E385E2", "versionEndExcluding": "5.5.0", "versionStartIncluding": "5.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Gradio is an open-source Python package designed to enable quick builds of a demo or web application. If File or UploadButton components are used as a part of Gradio application to preview file content, an attacker with access to the application might abuse these components to read arbitrary files from the application server. This issue has been addressed in release version 5.5.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability."}, {"lang": "es", "value": "Gradio es un paquete Python de c\u00f3digo abierto dise\u00f1ado para permitir compilaciones r\u00e1pidas de una aplicaci\u00f3n web o de demostraci\u00f3n. Si se utilizan los componentes File o UploadButton como parte de la aplicaci\u00f3n Gradio para obtener una vista previa del contenido de un archivo, un atacante con acceso a la aplicaci\u00f3n podr\u00eda abusar de estos componentes para leer archivos arbitrarios del servidor de aplicaciones. Este problema se ha solucionado en la versi\u00f3n 5.5.0 y se recomienda a todos los usuarios que la actualicen. No se conocen workarounds para esta vulnerabilidad."}], "id": "CVE-2024-51751", "lastModified": "2026-06-17T08:06:15.817", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-51751", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-11-06T19:54:26.224028Z", "version": "2.0.3"}}]}, "published": "2024-11-06T20:15:05.557", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/gradio-app/gradio/security/advisories/GHSA-rhm9-gp5p-5248"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{}