Moderate severityNVD Advisory· Published Nov 4, 2024· Updated Nov 6, 2024

CVE-2024-48052

Description

In gradio <=4.42.0, the gr.DownloadButton function has a hidden server-side request forgery (SSRF) vulnerability. The reason is that within the save_url_to_cache function, there are no restrictions on the URL, which allows access to local target resources. This can lead to the download of local resources and sensitive information.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
gradioPyPI	<= 4.42.0	—

Affected products

gradio/gradiodescription
ghsa-coords
pkg:pypi/gradio
Range: <= 4.42.0

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-3gf9-wv65-gwh9ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2024-48052ghsaADVISORY
gist.github.com/AfterSnows/45ffc23797f9127e00755376cc610e12ghsaWEB
rumbling-slice-eb0.notion.site/FULL-SSRF-in-gr-DownloadButton-in-gradio-app-gradio-870b21e0908b48cbafd914719ac1a4e6ghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.260
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000