CVE-2024-47172

Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. An attacker with a CVAT account may retrieve certain information about any project, task, job or membership resource on the CVAT instance. The information exposed in this way is the same as the information returned on a GET request to the resource. In addition, the attacker can also alter the default source and target storage associated with any project or task. Upgrade to CVAT 2.19.1 or any later version to fix the issue.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/cvat-ai/cvat/commit/59ce6ca784a0d426b2cfb8cf2850ba1d520c03f5	Patch
https://github.com/cvat-ai/cvat/security/advisories/GHSA-gxhm-hg65-5gh2	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:cvat:computer_vision_annotation_tool:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2024-09-30 15:15

Updated : 2024-10-30 18:20

NVD link : CVE-2024-47172

Mitre link : CVE-2024-47172

CVE.ORG link : CVE-2024-47172

JSON object : View

Products Affected

cvat

computer_vision_annotation_tool

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2024-47172", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}]}, "published": "2024-09-30T15:15:06.523", "references": [{"url": "https://github.com/cvat-ai/cvat/commit/59ce6ca784a0d426b2cfb8cf2850ba1d520c03f5", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/cvat-ai/cvat/security/advisories/GHSA-gxhm-hg65-5gh2", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. An attacker with a CVAT account may retrieve certain information about any project, task, job or membership resource on the CVAT instance. The information exposed in this way is the same as the information returned on a GET request to the resource. In addition, the attacker can also alter the default source and target storage associated with any project or task. Upgrade to CVAT 2.19.1 or any later version to fix the issue."}, {"lang": "es", "value": "Computer Vision Annotation Tool (CVAT) es una herramienta interactiva de anotaci\u00f3n de im\u00e1genes y videos para visi\u00f3n artificial. Un atacante con una cuenta CVAT puede recuperar cierta informaci\u00f3n sobre cualquier proyecto, tarea, trabajo o recurso de membres\u00eda en la instancia CVAT. La informaci\u00f3n expuesta de esta manera es la misma que la informaci\u00f3n devuelta en una solicitud GET al recurso. Adem\u00e1s, el atacante tambi\u00e9n puede alterar el almacenamiento de origen y destino predeterminado asociado con cualquier proyecto o tarea. Actualice a CVAT 2.19.1 o cualquier versi\u00f3n posterior para solucionar el problema."}], "lastModified": "2024-10-30T18:20:58.270", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cvat:computer_vision_annotation_tool:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E5639409-21F0-4AD7-91A7-1845A44DAA08", "versionEndExcluding": "2.19.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}