CVE-2024-1183
SSRF Vulnerability in gradio-app/gradio
An SSRF (Server-Side Request Forgery) vulnerability exists in the gradio-app/gradio repository, allowing attackers to scan and identify open ports within an internal network. By manipulating the 'file' parameter in a GET request, an attacker can discern the status of internal ports based on the presence of a 'Location' header or a 'File not allowed' error in the response.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
SSRF Vulnerability in gradio-app/gradio
An SSRF (Server-Side Request Forgery) vulnerability exists in the gradio-app/gradio repository, allowing attackers to scan and identify open ports within an internal network. By manipulating the 'file' parameter in a GET request, an attacker can discern the status of internal ports based on the presence of a 'Location' header or a 'File not allowed' error in the response.
- Record
CVE-2024-1183- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
EUVDEUVD-2024-1278
An SSRF (Server-Side Request Forgery) vulnerability exists in the gradio-app/gradio repository, allowing attackers to scan and identify open ports within an internal network. By manipulating the 'file' parameter in a GET request, an attacker can discern the status of internal ports based on the presence of a 'Location' header or a 'File not allowed' error in the response.
- Record
EUVD-2024-1278- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qh6x-j82h-vpf9
gradio Server-Side Request Forgery vulnerability
An SSRF (Server-Side Request Forgery) vulnerability exists in the gradio-app/gradio repository, allowing attackers to scan and identify open ports within an internal network. By manipulating the 'file' parameter in a GET request, an attacker can discern the status of internal ports based on the presence of a 'Location' header or a 'File not allowed' error in the response.
- Record
GHSA-qh6x-j82h-vpf9- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
NVD
An SSRF (Server-Side Request Forgery) vulnerability exists in the gradio-app/gradio repository, allowing attackers to scan and identify open ports within an internal network. By manipulating the 'file' parameter in a GET request, an attacker can discern the status of internal ports based on the presence of a 'Location' header or a 'File not allowed' error in the response.
- Record
CVE-2024-1183- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
OSV
SSRF Vulnerability in gradio-app/gradio
An SSRF (Server-Side Request Forgery) vulnerability exists in the gradio-app/gradio repository, allowing attackers to scan and identify open ports within an internal network. By manipulating the 'file' parameter in a GET request, an attacker can discern the status of internal ports based on the presence of a 'Location' header or a 'File not allowed' error in the response.
- Record
CVE-2024-1183- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
OSVGHSA-qh6x-j82h-vpf9
gradio Server-Side Request Forgery vulnerability
An SSRF (Server-Side Request Forgery) vulnerability exists in the gradio-app/gradio repository, allowing attackers to scan and identify open ports within an internal network. By manipulating the 'file' parameter in a GET request, an attacker can discern the status of internal ports based on the presence of a 'Location' header or a 'File not allowed' error in the response.
- Record
GHSA-qh6x-j82h-vpf9- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
OSVPYSEC-2026-1419
gradio Server-Side Request Forgery vulnerability
An SSRF (Server-Side Request Forgery) vulnerability exists in the gradio-app/gradio repository, allowing attackers to scan and identify open ports within an internal network. By manipulating the 'file' parameter in a GET request, an attacker can discern the status of internal ports based on the presence of a 'Location' header or a 'File not allowed' error in the response.
- Record
PYSEC-2026-1419- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gradioPyPI |
before 4.10.0 | 4.10.0 |
gradioPyPI |
before 4.10.0, plus listed versions 0.1.00.1.10.1.20.1.30.1.4 Show 45 moreShow less0.1.50.1.60.1.70.1.80.1.90.2.00.2.10.3.00.3.10.3.20.3.30.3.40.3.50.4.00.4.10.4.20.4.40.5.00.7.00.7.10.7.20.7.30.7.40.7.50.7.60.7.70.7.80.8.00.8.10.9.00.9.10.9.20.9.30.9.40.9.50.9.60.9.70.9.80.9.9.20.9.9.30.9.9.50.9.9.60.9.9.70.9.9.80.9.9.9 |
4.10.0 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Nuclei | Gradio - Server Side Request Forgery |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, Nuclei, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-1183 is a medium vulnerability (CVSS 6.5) in Gradio-app Gradio-app/gradio, published April 16, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.80%, the 78th percentile. Fixed in gradio 4.10.0.
References
huntr.com/bounties/103434f9-87d2-42ea-9907-194a3c25007c
github.com/gradio-app/gradio/commit/2ad3d9e7ec6c8eeea59774265b44f11df7394bb4
nvd.nist.gov/vuln/detail/CVE-2024-1183
pypi.org/project/gradio
Left out here: 447 versions. The JSON record has them.