CVE-2024-1183CWE-601

SSRF Vulnerability in gradio-app/gradio

Medium · published April 16, 2024

CVSS v3.0
6.5
EPSS
2%
Percentile
78.3
In the wild
Unconfirmed
What it is

An SSRF (Server-Side Request Forgery) vulnerability exists in the gradio-app/gradio repository, allowing attackers to scan and identify open ports within an internal network. By manipulating the 'file' parameter in a GET request, an attacker can discern the status of internal ports based on the presence of a 'Location' header or a 'File not allowed' error in the response.

The record
Technical detail
CVSS v3.0
6.5 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01799 · 78.3th percentile
Weakness
CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
Published
2024-04-16T00:00Z
EPSS history
Timeline
  • 16 APR 00:00Z
    SSRF Vulnerability in gradio-app/gradio
    cvelistv5