CVE-2024-39903
A Local File Inclusion (LFI) vulnerability was identified in widgetti/solara, in version <1.35.1, which was fixed in version 1.35.1.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.88%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Solara is a pure Python, React-style framework for scaling Jupyter and web apps. A Local File Inclusion (LFI) vulnerability was identified in widgetti/solara, in version <1.35.1, which was fixed in version 1.35.1. This vulnerability arises from the application's failure to properly validate URI fragments for directory traversal sequences such as '../' when serving static files. An attacker can exploit this flaw by manipulating the fragment part of the URI to read arbitrary files on the local file system.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 2.88% probability · 86th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-22
- Affected
- widgetti/solara
- Source
- security-advisories@github.com
References
- https://github.com/widgetti/solara/commit/df2fd66a7f4e8ffd36e8678697a8a4f76760dc54Patch
- https://github.com/widgetti/solara/security/advisories/GHSA-9794-pc4r-438wVendor Advisory
- https://github.com/widgetti/solara/commit/df2fd66a7f4e8ffd36e8678697a8a4f76760dc54Patch
- https://github.com/widgetti/solara/security/advisories/GHSA-9794-pc4r-438wVendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.