Description

Solara is a pure Python, React-style framework for scaling Jupyter and web apps. A Local File Inclusion (LFI) vulnerability was identified in widgetti/solara, in version <1.35.1, which was fixed in version 1.35.1. This vulnerability arises from the application's failure to properly validate URI fragments for directory traversal sequences such as '../' when serving static files. An attacker can exploit this flaw by manipulating the fragment part of the URI to read arbitrary files on the local file system.

INFO

Published Date :

2024-07-12T14:28:15.073Z

Last Modified :

2024-08-02T04:33:11.210Z

Source :

GitHub_M
AFFECTED PRODUCTS

The following products are affected by CVE-2024-39903 vulnerability.

Vendors Products
Widgetti
  • Solara
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2024-39903.

URL Resource
https://github.com/widgetti/solara/commit/df2fd66a7f4e8ffd36e8678697a8a4f76760dc54 cve-icon cve-icon cve-icon
https://github.com/widgetti/solara/security/advisories/GHSA-9794-pc4r-438w cve-icon cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact