Vulnerability · Published Aug 1, 2022 · Assigned by GitHub_M
CVE-2022-31188Server-Side Request Forgery Vulnerability in Computer Vision Annotation Tool (CVAT)
High 8.6
In plain English
A high-severity server-side request forgery in cvat from cvat-ai. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 48.2% (higher than 99% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
CVAT is an opensource interactive video and image annotation tool for computer vision. Versions prior to 2.0.0 were found to be subject to a Server-side request forgery (SSRF) vulnerability. Validation has been added to urls used in the affected code path in version 2.0.0. Users are advised to upgrade. There are no known workarounds for this issue.
Affected products (as reported)
Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L