CVE-2024-31462

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-31462
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-31462.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-31462
Published
2024-04-12T21:41:46Z
Modified
2026-08-12T03:30:31Z
Severity
  • 6.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
Summary
Limited file write in Stable-diffusion-webui - GHSL-2024-010
Details

stable-diffusion-webui is a web interface for Stable Diffusion, implemented using Gradio library. Stable-diffusion-webui 1.7.0 is vulnerable to a limited file write affecting Windows systems. The create_ui method (Backup/Restore tab) in modules/ui_extensions.py takes user input into the config_save_name variable on line 653. This user input is later used in the save_config_state method and used to create a file path on line 65, which is afterwards opened for writing on line 67, which leads to a limited file write exploitable on Windows systems. This issue may lead to limited file write. It allows for writing json files anywhere on the server where the web server has access.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-22"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/31xxx/CVE-2024-31462.json"
}
References

Affected packages

Git / github.com/automatic1111/stable-diffusion-webui

Affected ranges

Type
GIT
Repo
https://github.com/automatic1111/stable-diffusion-webui
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
d9708c92b444894bce8070e4dcfaa093f8eb8d43
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.8.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v1.*
v1.0.0-pre
v1.1.0
v1.1.1
v1.2.0
v1.2.1
v1.3.0
v1.3.1
v1.3.2
v1.4.0
v1.4.1
v1.5.0-RC
v1.5.1-RC
v1.5.2-RC
v1.6.0-RC
v1.7.0-RC
v1.9.0-RC

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-31462.json"