Vulnerability · Published Sep 30, 2024 · Assigned by GitHub_M

CVE-2024-47064Computer Vision Annotation Tool (CVAT) contains a reflected XSS via request endpoints

Medium 6.3

In plain English

A medium-severity cross-site scripting in cvat from cvat-ai. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).

Severity (CVSS 4.0)6.3Medium

Exploit odds (30 days)0.3%top 76.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. If an attacker can trick a logged-in CVAT user into visiting a maliciously-constructed URL, they can initiate any API calls on that user's behalf. This gives the attacker temporary access to all data that the victim user has access to. Upgrade to CVAT 2.19.0 or a later version to fix this issue.

Affected products (as reported)

Vendor	Product	Versions
cvat-ai	cvat	>= 2.16.0, < 2.19.0

Weakness: CWE-79, CWE-81 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

References

https://github.com/cvat-ai/cvat/security/advisories/GHSA-hp6c-f34j-qjj7 x_refsource_CONFIRM
https://github.com/cvat-ai/cvat/commit/0bf45fd5de08a652dffbfb517318a64c2fdbc5cf x_refsource_MISC