CVE-2024-47168— The `enable_monitoring` flag set to `False` does not disable monitoring in Gradio
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2024-47168
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
The `enable_monitoring` flag set to `False` does not disable monitoring in Gradio
Source: NVD (National Vulnerability Database)
Vulnerability Description
Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves data exposure due to the enable_monitoring flag not properly disabling monitoring when set to False. Even when monitoring is supposedly disabled, an attacker or unauthorized user can still access the monitoring dashboard by directly requesting the /monitoring endpoint. This means that sensitive application analytics may still be exposed, particularly in environments where monitoring is expected to be disabled. Users who set enable_monitoring=False to prevent unauthorized access to monitoring data are impacted. Users are advised to upgrade to gradio>=4.44 to address this issue. There are no known workarounds for this vulnerability.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
控制流实现总是不正确
Source: NVD (National Vulnerability Database)
Vulnerability Title
Gradio 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Gradio是Hugging Face开源的一个开源 Python 库，是通过友好的 Web 界面演示机器学习模型的方法。 Gradio存在安全漏洞，该漏洞源于即使在监控被禁用的情况下，攻击者或未经授权的用户仍然可以通过直接请求 /monitoring 端点来访问监控仪表板。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| gradio-app | gradio | < 4.44 | - |
II. Public POCs for CVE-2024-47168
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-47168
请登录查看更多情报信息。
Same Patch Batch · gradio-app · 2024-10-10 · 12 CVEs total
| CVE-2024-47166 | One-level read path traversal in `/custom_component` in Gradio | |
| CVE-2024-47872 | Cross-site Scripting on Gradio server via upload of HTML files, JS files, or SVG files | |
| CVE-2024-47165 | CORS origin validation accepts the null origin in Gradio | |
| CVE-2024-47167 | SSRF in the path parameter of /queue/join in Gradio | |
| CVE-2024-47867 | Lack of integrity check on the downloaded FRP client in Gradio | |
| CVE-2024-47084 | CORS origin validation is not performed when the request has a cookie in Gradio | |
| CVE-2024-47870 | Race condition in update_root_in_config may redirect user traffic in Gradio | |
| CVE-2024-47871 | Insecure communication between the FRP client and server in Gradio | |
| CVE-2024-47164 | The `is_in_or_equal` function may be bypassed in Gradio | |
| CVE-2024-47869 | Non-constant-time comparison when comparing hashes in Gradio | |
| CVE-2024-47868 | Several components’ post-process steps may allow arbitrary file leaks in Gradio |
IV. Related Vulnerabilities
Same product: gradio
- CVE-2026-28416
Gradio has SSRF via Malicious `proxy_url` Injection in `gr.l - CVE-2026-28415
Gradio has Open Redirect in OAuth Flow - CVE-2026-28414
Gradio has Absolute Path Traversal on Windows with Python 3. - CVE-2026-27167
Gradio: Mocked OAuth Login Exposes Server Credentials and Us - CVE-2025-48889
Gradio Allows Unauthorized File Copy via Path Manipulation
Same vendor: gradio-app
- CVE-2026-28416
Gradio has SSRF via Malicious `proxy_url` Injection in `gr.l - CVE-2026-28415
Gradio has Open Redirect in OAuth Flow - CVE-2026-28414
Gradio has Absolute Path Traversal on Windows with Python 3. - CVE-2026-27167
Gradio: Mocked OAuth Login Exposes Server Credentials and Us - CVE-2025-48889
Gradio Allows Unauthorized File Copy via Path Manipulation
V. Comments for CVE-2024-47168
No comments yet