Moderate severityNVD Advisory· Published Mar 21, 2024· Updated Aug 1, 2024
CSRF Vulnerability in gradio-app/gradio
CVE-2024-1727
Description
A Cross-Site Request Forgery (CSRF) vulnerability in gradio-app/gradio allows attackers to upload multiple large files to a victim's system if they are running Gradio locally. By crafting a malicious HTML page that triggers an unauthorized file upload to the victim's server, an attacker can deplete the system's disk space, potentially leading to a denial of service. This issue affects the file upload functionality as implemented in gradio/routes.py.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
gradioPyPI | < 4.19.2 | 4.19.2 |
Affected products
2- Range: unspecified
Patches
Vulnerability mechanics
References
6- github.com/advisories/GHSA-48cq-79qq-6f7xghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2024-1727ghsaADVISORY
- github.com/gradio-app/gradio/commit/84802ee6a4806c25287344dce581f9548a99834aghsaWEB
- github.com/gradio-app/gradio/pull/7503ghsaWEB
- github.com/gradio-app/gradio/security/advisories/GHSA-48cq-79qq-6f7xghsaWEB
- huntr.com/bounties/a94d55fb-0770-4cbe-9b20-97a978a2ffffghsaWEB
News mentions
0No linked articles in our index yet.