CVE-2024-45601

Local file Inclusion via static file serving functionality in Mesop

Description

Mesop is a Python-based UI framework designed for rapid web apps development. A vulnerability has been discovered and fixed in Mesop that could potentially allow unauthorized access to files on the server hosting the Mesop application. The vulnerability was related to insufficient input validation in a specific endpoint. This could have allowed an attacker to access files not intended to be served. Users are strongly advised to update to the latest version of Mesop immediately. The latest version includes a fix for this vulnerability. At time of publication 0.12.4 is the most recently available version of Mesop.

Category

7.5
CVSS
Severity: High
CVSS 3.1 •
EPSS 0.13%
Affected: google mesop
Published at:
Updated at:

References

Link Tags
https://github.com/google/mesop/security/advisories/GHSA-pmv9-3xqp-8w42
https://github.com/google/mesop/commit/17fb769d6a91f0a8cbccfab18f64977b158a6a31

Frequently Asked Questions

What is the severity of CVE-2024-45601?
CVE-2024-45601 has been scored as a high severity vulnerability.
How to fix CVE-2024-45601?
To fix CVE-2024-45601, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2024-45601 being actively exploited in the wild?
As for now, there are no information to confirm that CVE-2024-45601 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2024-45601?
CVE-2024-45601 affects google mesop.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.