Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2022-31188

CVAT is an opensource interactive video and image annotation tool for computer vision. Versions prior to 2.0.0 were found to be subject to a Server-side request forgery (SSRF) vulnerability. Validation has been added to urls used in the affected code path in version 2.0.0. Users are advised to upgrade. There are no known workarounds for this issue.

Published

2022-08-01T20:15:08.650

Last Modified

2024-11-21T07:04:05.067

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 8.6 (HIGH)

Weaknesses

Type: Secondary
CWE-918
Type: Primary
CWE-918

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	cvat	cvat	< 2.0.0	Yes

References

http://packetstormsecurity.com/files/169814/CVAT-2.0-Server-Side-Request-Forgery.html Exploit, Third Party Advisory, VDB Entry ([email protected])
https://github.com/cvat-ai/cvat/commit/6fad1764efd922d99dbcda28c4ee72d071aa5a07 Patch, Third Party Advisory ([email protected])
https://github.com/cvat-ai/cvat/security/advisories/GHSA-7vpj-j5xv-29pr Patch, Third Party Advisory ([email protected])
http://packetstormsecurity.com/files/169814/CVAT-2.0-Server-Side-Request-Forgery.html Exploit, Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/cvat-ai/cvat/commit/6fad1764efd922d99dbcda28c4ee72d071aa5a07 Patch, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/cvat-ai/cvat/security/advisories/GHSA-7vpj-j5xv-29pr Patch, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)