What is the CVSS score of CVE-2024-1729?

CVE-2024-1729 has a CVSS 3.0 base score of 5.9 (Medium). CVSS vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.5%.

Is there a public PoC exploit available for CVE-2024-1729?

Yes, a public proof-of-concept exploit is available for CVE-2024-1729. Prioritise patching immediately. EPSS: 0.5%.

Is there a patch available for CVE-2024-1729?

Yes, a patch is available for CVE-2024-1729. Update the affected software to the latest version immediately.

Gradio CVE-2024-1729

MEDIUM

Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)

2024-03-29 security@huntr.dev

Authentication Bypass Gradio

5.9

CVSS 3.0 · Vendor: huntr

Severity by source

Vendor (huntr) PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from Vendor (huntr) · only source for this CVE.

CVSS VectorVendor: huntr

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

Mar 29, 2024 - 05:15 cve.org

MEDIUM 5.9

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

3 pypi packages depend on gradio (3 direct, 0 indirect)

Ecosystem-wide dependent count for version 4.19.2.

DescriptionCVE.org

A timing attack vulnerability exists in the gradio-app/gradio repository, specifically within the login function in routes.py. The vulnerability arises from the use of a direct comparison operation (app.auth[username] == password) to validate user credentials, which can be exploited to guess passwords based on response times. Successful exploitation of this vulnerability could allow an attacker to bypass authentication mechanisms and gain unauthorized access.

AnalysisAI

A timing attack vulnerability exists in the gradio-app/gradio repository, specifically within the login function in routes.py. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.

Technical ContextAI

This vulnerability is classified under CWE-367. A timing attack vulnerability exists in the gradio-app/gradio repository, specifically within the login function in routes.py. The vulnerability arises from the use of a direct comparison operation (app.auth[username] == password) to validate user credentials, which can be exploited to guess passwords based on response times. Successful exploitation of this vulnerability could allow an attacker to bypass authentication mechanisms and gain unauthorized access. Affected products include: Gradio Project Gradio.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.