CVE-2024-47168 json
The `enable_monitoring` flag set to `False` does not disable monitoring in Gradio
published 2y ago modified 4mo ago also EUVD-2024-0066 , GHSA-hm3c-93pg-4cxw , PYSEC-2024-198
- cvss
- 4.3
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 26%
- public exploits
- 0
- none known
Summary
Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves data exposure due to the enable_monitoring flag not properly disabling monitoring when set to False. Even when monitoring is supposedly disabled, an attacker or unauthorized user can still access the monitoring dashboard by directly requesting the /monitoring endpoint. This means that sensitive application analytics may still be exposed, particularly in environments where monitoring is expected to be disabled. Users who set enable_monitoring=False to prevent unauthorized access to monitoring data are impacted. Users are advised to upgrade to gradio>=4.44 to address this issue. There are no known workarounds for this vulnerability.
Patch / fix
- pypi gradio 4.44.0
- gradio-app gradio 4.44
- gradio_project gradio 4.44
Is CVE-2024-47168 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2y ago
Exploit prediction
0.33% chance of exploitation in the next 30 days, higher than 26% of all scored CVEs (FIRST EPSS, 2026-11-11).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 2.3 | CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
| GitHub | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| CNA | 4.0 | 2.3 | CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| OSV | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | gradio | <4.44.0 |
4.44.0 |
Affected products
- gradio-app gradio
Classification
- Weakness
-
- CWE-670 Always-Incorrect Control Flow Implementation
References
-
github.com
/gradio-app/gradio/security/advisories/GHSA-hm3c-93pg-4cxw
web, third-party-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-47168
advisory
-
github.com
/gradio-app/gradio
package
-
github.com
/pypa/advisory-database/tree/main/vulns/gradio/PYSEC-2024-198.yaml
web
Sources
- CVE List CVE-2024-47168
- GitHub Advisory GHSA-hm3c-93pg-4cxw
- NVD CVE-2024-47168
- OSV PYSEC-2024-198
- Maintainer advisory GHSA-hm3c-93pg-4cxw
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
The maintainers of gradio-app/gradio published their own advisory on GitHub. Reviewed sources take precedence over it.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.