Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2024-42474— Streamlit Path Traversal Security Vulnerability on Windows

Quick assessment

Affected
streamlit streamlit
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Streamlit是Streamlit开源的一个面向数据的 Python 应用程序开发框架。 Streamlit 1.37.0之前版本存在安全漏洞。攻击者利用该漏洞可以泄露运行Streamlight的Windows用户的密码哈希。

AI Predicted 7.5 Difficulty: Easy EPSS 0.57% · P45

Possible ATT&CK Techniques 1 AI

T1005 · Data from Local System
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2024-42474

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Streamlit Path Traversal Security Vulnerability on Windows
Source: CVE Program / CVE List V5
Vulnerability Description
Streamlit is a data oriented application development framework for python. Snowflake Streamlit open source addressed a security vulnerability via the static file sharing feature. Users of hosted Streamlit app(s) on Windows were vulnerable to a path traversal vulnerability when the static file sharing feature is enabled. An attacker could utilize the vulnerability to leak the password hash of the Windows user running Streamlit. The vulnerability was patched on Jul 25, 2024, as part of Streamlit open source version 1.37.0. The vulnerability only affects Windows.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Vulnerability Title
Streamlit 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Streamlit是Streamlit开源的一个面向数据的 Python 应用程序开发框架。 Streamlit 1.37.0之前版本存在安全漏洞。攻击者利用该漏洞可以泄露运行Streamlight的Windows用户的密码哈希。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
streamlit streamlit < 1.37.0 -

II. Public POCs for CVE-2024-42474

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2024-42474

请登录查看更多情报信息。

Patches & Fixes for CVE-2024-42474 (1)

Vendor Advisories for CVE-2024-42474 (1)

IV. Related Vulnerabilities

Same product: streamlit
Same vendor: streamlit
Same weakness: CWE-22

V. Comments for CVE-2024-42474

No comments yet

Leave a comment