PT-2024-17278 · Gradio · Gradio

Published 2024-04-15 · Updated 2025-07-29 · CVE-2024-1183

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions gradio-app/gradio (affected versions not specified)

Description A Server-Side Request Forgery (SSRF) issue exists, allowing attackers to scan and identify open ports within an internal network. By manipulating the file parameter in a GET request, an attacker can discern the status of internal ports based on the presence of a 'Location' header or a 'File not allowed' error in the response.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2024-1183

GHSA-QH6X-J82H-VPF9

Affected Products

Gradio

References · 11

• 🔥 https://huntr.com/bounties/103434f9-87d2-42ea-9907-194a3c25007c · Exploit
• https://github.com/gradio-app/gradio/commit/2ad3d9e7ec6c8eeea59774265b44f11df7394bb4 · Patch
• https://osv.dev/vulnerability/GHSA-qh6x-j82h-vpf9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-1183 · Security Note
• https://osv.dev/vulnerability/CVE-2024-1183 · Vendor Advisory
• https://github.com/gradio-app/gradio · Note
• https://github.com/gradio-app/gradio/commit/7ba8c5da45b004edd12c0460be9222f5b5f5f055 · Note
• https://t.me/cveNotify/130146 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1780119374801633332 · Twitter Post
• https://t.me/cvenotify/76888 · Telegram Post
• https://twitter.com/CVEnew/status/1780039215872610708 · Twitter Post