CVSS 3.0
6.5 mediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NCVE-2024-1183
Medium (6.5) in gradio project gradio. EPSS 1.8% chance of exploitation in the next 30 days. Fixed in gradio 4.10.0.
An SSRF (Server-Side Request Forgery) vulnerability exists in the gradio-app/gradio repository, allowing attackers to scan and identify open ports within an internal network. By manipulating the 'file' parameter in a GET request, an attacker can discern the status of internal ports based on the presence of a 'Location' header or a 'File not allowed' error in the response.
Severity
- EPSS
- 1.8% chance of exploitation in the next 30 days; higher than 78% of CVEs (scores of 2026-10-31)
- CWE
- CWE-601
- Published
- Modified
- Record from
- the NVD, synced
Affected
- gradio_project:gradio
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-qh6x-j82h-vpf9 | PyPI | gradio | <4.10.0 | 4.10.0 |
| PYSEC-2026-1419 | PyPI | gradio | <4.10.0 | 4.10.0 |