PT-2023-21169 · Streamlit · Streamlit

CVE-2023-27494 · Publicado 2023-03-16 · Atualizado 2024-08-13

Positive Technologies (AI Summary)

CVSS v4.0

6.0

Média

Vetor base

AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Streamlit versions 0.63.0 through 0.80.0

Description The issue is a cross-site scripting (XSS) vulnerability that affects users of hosted Streamlit apps. An attacker could craft a malicious URL with Javascript payloads to a Streamlit app, tricking the user into visiting it. If successful, the server would render the malicious javascript payload as-is, leading to XSS.

Recommendations For versions 0.63.0 through 0.80.0, update to version 0.81.0 or later to patch the vulnerability. As a temporary workaround, consider restricting access to hosted Streamlit apps to minimize the risk of exploitation. Avoid using malicious URLs with Javascript payloads in Streamlit apps until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-27494

GHSA-9C6G-QPGJ-RVXW

PYSEC-2023-50

Produtos afetados

Streamlit

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/27xxx/CVE-2023-27494.json · Exploit
• https://github.com/streamlit/streamlit · Nota
• https://github.com/streamlit/streamlit/security/advisories/GHSA-9c6g-qpgj-rvxw · Aviso do Fabricante
• https://github.com/streamlit/streamlit/commit/afcf880c60e5d7538936cc2d9721b9e1bc02b075 · Correção
• https://github.com/pypa/advisory-database/tree/main/vulns/streamlit/PYSEC-2023-50.yaml · Nota
• https://osv.dev/vulnerability/CVE-2023-27494 · Aviso do Fabricante
• https://t.me/cvenotify/90258 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-27494 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-9c6g-qpgj-rvxw · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2023-50 · Aviso do Fabricante