CVE-2024-47084

Gradio is an open-source Python package designed for quick prototyping. This vulnerability is related to **CORS origin validation**, where the Gradio server fails to validate the request origin when a cookie is present. This allows an attacker’s website to make unauthorized requests to a local Gradio server. Potentially, attackers can upload files, steal authentication tokens, and access user data if the victim visits a malicious website while logged into Gradio. This impacts users who have deployed Gradio locally and use basic authentication. Users are advised to upgrade to `gradio>4.44` to address this issue. As a workaround, users can manually enforce stricter CORS origin validation by modifying the `CustomCORSMiddleware` class in their local Gradio server code. Specifically, they can bypass the condition that skips CORS validation for requests containing cookies to prevent potential exploitation.

• CWE-285

• https://github.com/gradio-app/gradio/security/advisories/GHSA-3c67-5hwx-f6wxMitigation, Third Party Advisory

Published

Oct 10, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-47079Meshtastic is an open source, off-grid, decentralized, mesh …6.4
• CVE-2024-4708mySCADA myPRO uses a hard-coded password which could allow…9.8
• CVE-2024-47080matrix-js-sdk is the Matrix Client-Server SDK for JavaScript…8.7
• CVE-2024-47081Requests is a HTTP library. Due to a URL parsing issue, Requ…5.3
• CVE-2024-47082Strawberry GraphQL is a library for creating GraphQL APIs. P…8
• CVE-2024-47083Power Platform Terraform Provider allows managing environmen…7.5
• CVE-2024-47085This vulnerability exists in Apex Softcell LD DP Back Office…6.5
• CVE-2024-47086This vulnerability exists in Apex Softcell LD DP Back Office…6.5
• CVE-2024-47087This vulnerability exists in Apex Softcell LD Geo due to imp…6.5
• CVE-2024-47088This vulnerability exists in Apex Softcell LD Geo due to mis…9.8
• CVE-2024-47089This vulnerability exists in the Apex Softcell LD Geo due to…6.5
• CVE-2024-4709The Contact Form Plugin by Fluent Forms for Quiz, Survey, an…6.4