CVE-2024-4940
Published: 22 June 2024
Summary
CVE-2024-4940 is a medium-severity Open Redirect (CWE-601) vulnerability in Gradio Project Gradio. Its CVSS base score is 6.1 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Spearphishing Link (T1566.002); ranked in the top 8.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
This vulnerability is AI-related — categorised as Other Platforms; in the Other ATLAS/OWASP Terms risk domain.
Deeper analysis
An open redirect vulnerability tracked as CVE-2024-4940 affects the latest version of gradio-app/gradio. The flaw arises from improper validation of user-supplied input during URL handling and is assigned CWE-601 with a CVSS 3.1 score of 6.1.
An unauthenticated attacker can supply a crafted URL that causes the application to redirect victims to an arbitrary external site. Successful exploitation can be chained into phishing campaigns, cross-site scripting, server-side request forgery, or other follow-on attacks that rely on the redirected user context.
EPSS for the CVE remains flat at 0.0724 with no material rise from its recorded peak. The issue was disclosed via a huntr.com bounty entry.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-2050
Vulnerability details
An open redirect vulnerability exists in the gradio-app/gradio, affecting the latest version. The vulnerability allows an attacker to redirect users to arbitrary websites, which can be exploited for phishing attacks, Cross-site Scripting (XSS), Server-Side Request Forgery (SSRF), amongst others. This…
more
issue is due to improper validation of user-supplied input in the handling of URLs. Attackers can exploit this vulnerability by crafting a malicious URL that, when processed by the application, redirects the user to an attacker-controlled web page.
- CWE(s)
AI Security AnalysisAI
- AI Category
- Other Platforms
- Risk Domain
- Other ATLAS/OWASP Terms
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- Gradio is an open-source Python library for creating web-based UIs and demos for machine learning models, fitting as an 'Other Platforms' category for AI/ML deployment tools. The vulnerability is an open redirect in a tool used in AI/ML workflows, confirmed AI-related via huntr.com AI/ML bounty platform.
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The open redirect vulnerability enables attackers to craft malicious URLs that redirect users to arbitrary attacker-controlled websites, facilitating spearphishing link attacks.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.