CVE-2024-47869

CVE-2024-47869 is a low-severity vulnerability in Gradio Project Gradio with a CVSS 3.x base score of 3.7. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-203.

Key facts

Description

Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves a **timing attack** in the way Gradio compares hashes for the `analytics_dashboard` function. Since the comparison is not done in constant time, an attacker could exploit this by measuring the response time of different requests to infer the correct hash byte-by-byte. This can lead to unauthorized access to the analytics dashboard, especially if the attacker can repeatedly query the system with different keys. Users are advised to upgrade to `gradio>4.44` to mitigate this issue. To mitigate the risk before applying the patch, developers can manually patch the `analytics_dashboard` dashboard to use a **constant-time comparison** function for comparing sensitive values, such as hashes. Alternatively, access to the analytics dashboard can be disabled.

Frequently asked questions

What is CVE-2024-47869?
Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves a **timing attack** in the way Gradio compares hashes for the `analytics_dashboard` function. Since the comparison is not done in constant time, an attacker could exploit this by measuring the response time of different requests to infer the correct hash byte-by-byte. This can lead to unauthorized access to the analytics dashboard, especially if the attacker can repeatedly query the system with different keys. Users are advised to upgrade to `gradio>4.44` to mitigate this issue. To mitigate the risk before applying the patch, developers can manually patch the `analytics_dashboard` dashboard to use a **constant-time comparison** function for comparing sensitive values, such as hashes. Alternatively, access to the analytics dashboard can be disabled.
How severe is CVE-2024-47869?
CVE-2024-47869 has a CVSS 3.x base score of 3.7, rated low severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.
Is CVE-2024-47869 being actively exploited?
It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (20th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2024-47869?
CVE-2024-47869 affects Gradio Project Gradio. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2024-47869?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2024-47869 have an EU (EUVD) identifier?
Yes. CVE-2024-47869 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-0067.
When was CVE-2024-47869 published?
CVE-2024-47869 was published on 2024-10-10 and last updated on 2026-06-17.

References

Affected products (1)

More vulnerabilities in Gradio Project Gradio

All CVEs affecting Gradio Project Gradio →

Other CWE-203 (Observable Discrepancy) vulnerabilities

Browse all CWE-203 (Observable Discrepancy) vulnerabilities →