CVE-2024-48052

In gradio <=4.42.0, the gr.DownloadButton function has a hidden server-side request forgery (SSRF) vulnerability

Medium · published November 4, 2024

CVSS v3.1
6.5
EPSS
0%
Percentile
39.7
In the wild
Unconfirmed
What it is

In gradio <=4.42.0, the gr.DownloadButton function has a hidden server-side request forgery (SSRF) vulnerability. The reason is that within the save_url_to_cache function, there are no restrictions on the URL, which allows access to local target resources. This can lead to the download of local resources and sensitive information.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00470 · 39.7th percentile
Published
2024-11-04T00:00Z
EPSS history
Timeline
  • 04 NOV 00:00Z
    In gradio <=4.42.0, the gr.DownloadButton function has a hidden server-side request forgery (SSRF) vulnerability
    cvelistv5