admin/cve
1
0
Fork 0
mirror of https://github.com/0xMarcio/cve.git synced 2025-05-05 10:17:57 +00:00
Code Issues Packages Projects Releases Wiki Activity
cve/2024/CVE-2024-41120.md
0xMarcio 3428c6bdc6 Update CVE sources 2024-08-05 18:41
2024-08-05 18:41:32 +00:00

1.1 KiB
Raw Permalink Blame History

CVE-2024-41120

Description

streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the url variable on line 63 of pages/9_🔲_Vector_Data_Visualization.py takes user input, which is later passed to the gpd.read_file method. gpd.read_file method creates a request to arbitrary destinations, leading to blind server-side request forgery. Commit c4f81d9616d40c60584e36abb15300853a66e489 fixes this issue.

POC

Reference

Github

No PoCs found on GitHub currently.