{"id":"CVE-2024-34510","published":"2024-05-05T00:00:00Z","modified":"2024-11-19T21:37:27Z","title":"Gradio before 4.20 allows credential leakage on Windows","vendor":null,"product":null,"tier":"tail","description":{"text":"Gradio before 4.20 allows credential leakage on Windows.","provenance":"source","from":"CVE.org"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AC:L/AV:N/A:N/C:H/I:N/PR:N/S:U/UI:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00667,"percentile":0.51716,"provenance":"source"},"cwes":[{"id":"CWE-116","name":"Improper Encoding or Escaping of Output"}],"references":[{"url":"https://github.com/gradio-app/gradio/","tags":[]},{"url":"https://www.gradio.app/changelog#4-20-0","tags":[]}],"priority":{"score":15.6,"factors":[{"name":"EPSS percentile","points":10.34},{"name":"CVSS severity","points":5.25}]},"affected":[{"ecosystem":"PyPI","package":"gradio","vulnerableRanges":["<4.20.0"],"patched":["4.20.0"],"from":["GHSA-rvfh-h6c7-fc3c","PYSEC-2024-255"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-35150","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2024-1727","published":"2024-03-21","fixed":"4.19.2","kev":false},{"cve":"CVE-2024-1728","published":"2024-04-10","fixed":"4.19.2","kev":false,"link":{"from":"CVE-2024-1728","to":"CVE-2024-34510","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:gradio","fromFixed":"4.19.2","toFixed":"4.20.0","daysApart":25}]}},{"cve":"CVE-2024-1729","published":"2024-03-29","fixed":"4.19.2","kev":false},{"cve":"CVE-2024-34510","published":"2024-05-05","fixed":"4.20.0","kev":false},{"cve":"CVE-2024-4253","published":"2024-06-04","fixed":"4.29.0","kev":false,"link":{"from":"CVE-2024-34510","to":"CVE-2024-4253","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:gradio","fromFixed":"4.20.0","toFixed":"4.29.0","daysApart":30}]}},{"cve":"CVE-2024-4941","published":"2024-06-06","fixed":"4.31.4","kev":false},{"cve":"CVE-2024-47084","published":"2024-10-10","fixed":"4.44.0","kev":false}],"package":"PyPI:gradio"}}