CVE-2024-4940

An open redirect vulnerability exists in the gradio-app/gradio, affecting the latest version. The vulnerability allows an attacker to redirect users to arbitrary websites, which can be exploited for phishing attacks, Cross-site Scripting (XSS), Server-Side Request Forgery (SSRF), amongst others. This issue is due to improper validation of user-supplied input in the handling of URLs. Attackers can exploit this vulnerability by crafting a malicious URL that, when processed by the application, redirects the user to an attacker-controlled web page.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://huntr.com/bounties/35aaea93-6895-4f03-9c1b-cd992665aa60	Exploit Third Party Advisory
https://huntr.com/bounties/35aaea93-6895-4f03-9c1b-cd992665aa60	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:gradio_project:gradio:4.36.0:*:*:*:*:python:*:*

History

29 Jul 2025, 23:55

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~5.4~~	v2 : unknown v3 : 6.1
References	~~() https://huntr.com/bounties/35aaea93-6895-4f03-9c1b-cd992665aa60 -~~	() https://huntr.com/bounties/35aaea93-6895-4f03-9c1b-cd992665aa60 - Exploit, Third Party Advisory
CPE		cpe:2.3:a:gradio_project:gradio:4.36.0:::::python::
First Time		Gradio Project Gradio Project gradio

Information

Published : 2024-06-22 06:15

Updated : 2025-07-29 23:55

NVD link : CVE-2024-4940

Mitre link : CVE-2024-4940

CVE.ORG link : CVE-2024-4940

JSON object : View

Products Affected

gradio_project

gradio

CWE

CWE-601

URL Redirection to Untrusted Site ('Open Redirect')

{"id": "CVE-2024-4940", "cveTags": [], "metrics": {"cvssMetricV30": [{"type": "Secondary", "source": "security@huntr.dev", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2024-06-22T06:15:11.137", "references": [{"url": "https://huntr.com/bounties/35aaea93-6895-4f03-9c1b-cd992665aa60", "tags": ["Exploit", "Third Party Advisory"], "source": "security@huntr.dev"}, {"url": "https://huntr.com/bounties/35aaea93-6895-4f03-9c1b-cd992665aa60", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@huntr.dev", "description": [{"lang": "en", "value": "CWE-601"}]}], "descriptions": [{"lang": "en", "value": "An open redirect vulnerability exists in the gradio-app/gradio, affecting the latest version. The vulnerability allows an attacker to redirect users to arbitrary websites, which can be exploited for phishing attacks, Cross-site Scripting (XSS), Server-Side Request Forgery (SSRF), amongst others. This issue is due to improper validation of user-supplied input in the handling of URLs. Attackers can exploit this vulnerability by crafting a malicious URL that, when processed by the application, redirects the user to an attacker-controlled web page."}, {"lang": "es", "value": "Existe una vulnerabilidad de redireccionamiento abierto en gradio-app/gradio, que afecta a la \u00faltima versi\u00f3n. La vulnerabilidad permite a un atacante redirigir a los usuarios a sitios web arbitrarios, que pueden explotarse para ataques de phishing, Cross-Site Scripting (XSS) y Server-Side Request Forgery (SSRF), entre otros. Este problema se debe a una validaci\u00f3n inadecuada de la entrada proporcionada por el usuario en el manejo de las URL. Los atacantes pueden aprovechar esta vulnerabilidad creando una URL maliciosa que, cuando la aplicaci\u00f3n la procesa, redirige al usuario a una p\u00e1gina web controlada por el atacante."}], "lastModified": "2025-07-29T23:55:06.973", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gradio_project:gradio:4.36.0:*:*:*:*:python:*:*", "vulnerable": true, "matchCriteriaId": "AA9B1CC8-A70D-4EF1-A158-1328CE743AE5"}], "operator": "OR"}]}], "sourceIdentifier": "security@huntr.dev"}