GHSA-9794-pc4r-438w

Suggest an improvement
Source
https://github.com/advisories/GHSA-9794-pc4r-438w
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/07/GHSA-9794-pc4r-438w/GHSA-9794-pc4r-438w.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-9794-pc4r-438w
Aliases
Published
2024-07-12T21:00:21Z
Modified
2024-07-12T21:42:28.919923Z
Severity
  • 8.6 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L CVSS Calculator
Summary
Local File Inclusion in Solara
Details

A Local File Inclusion (LFI) vulnerability was identified in widgetti/solara, in version <1.35.1, which was fixed in version 1.35.1. This vulnerability arises from the application's failure to properly validate URI fragments for directory traversal sequences such as '../' when serving static files. An attacker can exploit this flaw by manipulating the fragment part of the URI to read arbitrary files on the local file system.

References

  • https://github.com/widgetti/solara/security/advisories/GHSA-9794-pc4r-438w
  • https://github.com/widgetti/solara/commit/df2fd66a7f4e8ffd36e8678697a8a4f76760dc54
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-39903
Database specific 
{
    "severity": "HIGH",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-22"
    ],
    "nvd_published_at": "2024-07-12T15:15:11Z",
    "github_reviewed_at": "2024-07-12T21:00:21Z"
}
References

Affected packages

PyPI / solara

Package

Name
solara
View open source insights on deps.dev
Purl
pkg:pypi/solara

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.35.1

Affected versions

0.*

0.0.1
0.0.2
0.0.3
0.0.4
0.0.5
0.0.6
0.1.0
0.1.1
0.1.2
0.2.0
0.3.0
0.4.0
0.4.1
0.4.3a4
0.5.0a0
0.5.0
0.5.1
0.5.2
0.7.0
0.8.0
0.8.1
0.9.0
0.9.1
0.10.0
0.10.1
0.10.2
0.10.3
0.10.4
0.11.0
0.12.0
0.12.1
0.13.0
0.14.0
0.15.0
0.16.0
0.17.0
0.18.0
0.18.1
0.18.2
0.18.3
0.19.0
0.19.1

1.*

1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.2.0
1.2.1
1.3.0
1.4.0
1.5.0
1.6.0
1.6.1
1.7.0
1.7.1
1.8.0
1.8.1
1.8.2
1.9.0
1.10.0
1.11.0
1.12.0
1.13.0
1.14.0
1.15.0
1.16.0
1.16.1
1.16.2
1.16.3
1.17.0
1.17.1
1.17.2
1.17.3
1.17.4
1.17.5
1.18.0
1.19.0
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.25.0
1.25.1
1.26.0
1.26.1
1.27.0
1.28.0
1.29.0
1.29.1
1.30.0
1.30.1
1.31.0
1.32.0
1.32.1
1.32.2
1.33.0
1.34.0
1.34.1
1.35.0