CVE-2022-31188 HIGH

CVE-2022-31188: Server-Side Request Forgery Vulnerability in Computer Vision Annotation Tool (CVAT)

Vendor Cvat-Ai
Product cvat
Weakness CWE-918 · SSRF
Published August 1, 2022
Last update April 22, 2025
View on NVD All CVEs

CVSS base score

8.6/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

What the vulnerability does

01Description

CVAT is an opensource interactive video and image annotation tool for computer vision. Versions prior to 2.0.0 were found to be subject to a Server-side request forgery (SSRF) vulnerability. Validation has been added to urls used in the affected code path in version 2.0.0. Users are advised to upgrade. There are no known workarounds for this issue.

Key dates

02Disclosure timeline

August 1, 2022 CVE published
April 22, 2025 Record updated