CVE-2023-27494mediumCWE-79

CVE-2023-27494: falha de média gravidade em streamlit

Streamlit Cross-site Scripting vulnerability

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar streamlit+ Monitorar streamlit

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.9epss 0.4%
Streamlit, software for turning data scripts into web applications, had a cross-site scripting (XSS) vulnerability in versions 0.63.0 through 0.80.0. Users of hosted Streamlit app(s) were vulnerable to a reflected XSS vulnerability. An attacker could craft a malicious URL with Javascript payloads to a Streamlit app. The attacker could then trick the user into visiting the malicious URL and, if successful, the server would render the malicious javascript payload as-is, leading to XSS. Version 0.81.0 contains a patch for this vulnerability.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N
Produtos afetados
streamlit · streamlit
CVEs relacionadas — streamlit

No mesmo produto, das mais perigosas para as menos.

CVE-2022-35918MEDIUMStreamlit directory traversal vulnerabilityEPSS 1.8%CVE-2024-42474MEDIUMStreamlit Path Traversal Security Vulnerability on WindowsEPSS 0.6%CVE-2026-33682MEDIUMStreamlit on Windows has Unauthenticated SSRF Vulnerability (NTLM Credential Exposure)EPSS 0.3%