CVE-2024-47869
Severity CVSS v4.0:
LOW
Type:
Unavailable / Other
Publication date:
10/10/2024
Last modified:
17/10/2024
Description
Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves a **timing attack** in the way Gradio compares hashes for the `analytics_dashboard` function. Since the comparison is not done in constant time, an attacker could exploit this by measuring the response time of different requests to infer the correct hash byte-by-byte. This can lead to unauthorized access to the analytics dashboard, especially if the attacker can repeatedly query the system with different keys. Users are advised to upgrade to `gradio>4.44` to mitigate this issue. To mitigate the risk before applying the patch, developers can manually patch the `analytics_dashboard` dashboard to use a **constant-time comparison** function for comparing sensitive values, such as hashes. Alternatively, access to the analytics dashboard can be disabled.
Impact
Base Score 4.0
2.30
Severity 4.0
LOW
Base Score 3.x
3.70
Severity 3.x
LOW
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:a:gradio_project:gradio:*:*:*:*:*:python:*:* | 4.44.0 (excluding) |
To consult the complete list of CPE names with products and versions, see this page