References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

Change History

https://github.com/gradio-app/gradio/commit/e329f1fd38935213fe0e73962e8cbd5d3af6e87b

https://huntr.com/bounties/f6a10a8d-f538-4cb7-9bb2-85d9f5708124

Th password check condition is vulnerable to timing attack to guess the password

A timing attack vulnerability exists in the gradio-app/gradio repository, specifically within the login function in routes.py. The vulnerability arises from the use of a direct comparison operation (`app.auth[username] == password`) to validate user credentials, which can be exploited to guess passwords based on response times. Successful exploitation of this vulnerability could allow an attacker to bypass authentication mechanisms and gain unauthorized access.

Th password check condition is vulnerable to timing attack to guess the password

huntr.dev AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

huntr.dev CWE-367

huntr.dev https://github.com/gradio-app/gradio/commit/e329f1fd38935213fe0e73962e8cbd5d3af6e87b [No types assigned]

huntr.dev https://huntr.com/bounties/f6a10a8d-f538-4cb7-9bb2-85d9f5708124 [No types assigned]