CVE-2023-27494mediumCWE-79

CVE-2023-27494: fallo de gravedad media en streamlit

Streamlit Cross-site Scripting vulnerability

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear streamlit+ Monitorear streamlit

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.9epss 0.4%
Streamlit, software for turning data scripts into web applications, had a cross-site scripting (XSS) vulnerability in versions 0.63.0 through 0.80.0. Users of hosted Streamlit app(s) were vulnerable to a reflected XSS vulnerability. An attacker could craft a malicious URL with Javascript payloads to a Streamlit app. The attacker could then trick the user into visiting the malicious URL and, if successful, the server would render the malicious javascript payload as-is, leading to XSS. Version 0.81.0 contains a patch for this vulnerability.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N
Productos afectados
streamlit · streamlit
CVEs relacionadas — streamlit

En el mismo producto, de las más peligrosas a las menos.

CVE-2022-35918MEDIUMStreamlit directory traversal vulnerabilityEPSS 1.8%CVE-2024-42474MEDIUMStreamlit Path Traversal Security Vulnerability on WindowsEPSS 0.6%CVE-2026-33682MEDIUMStreamlit on Windows has Unauthenticated SSRF Vulnerability (NTLM Credential Exposure)EPSS 0.3%