PT-2024-25942 · Gradio · Gradio

Published 2024-05-05 · Updated 2024-05-14 · CVE-2024-34511

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Gradio versions prior to 4.13

Description The issue arises from the Component Server in Gradio not properly considering is server fn for functions. This can lead to security risks if function calls do not take is server fn into account.

Recommendations For Gradio versions prior to 4.13, update to version 4.13 or later to resolve the issue. As a temporary workaround, consider ensuring that all function calls properly consider the is server fn variable to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2024-34511

GHSA-34RF-P3R3-58X2

Affected Products

Gradio

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2024-34511 · Security Note
• https://osv.dev/vulnerability/CVE-2024-34511 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-34rf-p3r3-58x2 · Vendor Advisory
• https://github.com/gradio-app/gradio · Note
• https://github.com/gradio-app/gradio/commit/24a583688046867ca8b8b02959c441818bdb34a2 · Note
• https://twitter.com/CVEnew/status/1787561512778993796 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1787250341844505020 · Twitter Post
• https://twitter.com/linuxpatch/status/1787227360409846058 · Twitter Post
• https://gradio.app/changelog#4-13-0 · Note
• https://t.me/cvenotify/79152 · Telegram Post