CVE-2021-43831

HIGH Year: 2021
CVSS v3 Score
7.7
High
CVSS v2 Score
3.5
Low
Weakness Type
CWE-22
View all →

Vulnerability Description

Gradio is an open source framework for building interactive machine learning models and demos. In versions prior to 2.5.0 there is a vulnerability that affects anyone who creates and publicly shares Gradio interfaces. File paths are not restricted and users who receive a Gradio link can access any files on the host computer if they know the file names or file paths. This is limited only by the host operating system. Paths are opened in read only mode. The problem has been patched in gradio 2.5.0.

Related Vulnerabilities

CVE-2017-2829

HIGH
CVSS:7.7(High)

An exploitable directory traversal vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request ...

CWE-222017

CVE-2018-5430

HIGH
CVSS:7.7(High)

The Spring web flows of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with M...

CWE-222018

CVE-2020-12102

HIGH
CVSS:7.7(High)

In Tiny File Manager 2.4.1, there is a Path Traversal vulnerability in the ajax recursive directory listing functionality. This allows authenticated users to enumerate directories and files on the fil...

CWE-222020

CVE-2020-12103

HIGH
CVSS:7.7(High)

In Tiny File Manager 2.4.1 there is a vulnerability in the ajax file backup copy functionality which allows authenticated users to create backup copies of files (with .bak extension) outside the scope...

CWE-222020

CVE-2020-13550

HIGH
CVSS:7.7(High)

A local file inclusion vulnerability exists in the installation functionality of Advantech WebAccess/SCADA 9.0.1. A specially crafted application can lead to information disclosure. An attacker can se...

CWE-222020

CVE-2020-16136

HIGH
CVSS:7.7(High)

In tgstation-server 4.4.0 and 4.4.1, an authenticated user with permission to download logs can download any file on the server machine (accessible by the owner of the server process) via directory tr...

CWE-222020