CVE-2024-47172 MEDIUM

CVE-2024-47172: Computer Vision Annotation Tool (CVAT) access control is broken in several PATCH endpoints

Vendor Cvat-Ai
Product cvat
Weakness CWE-863 · Incorrect authorization
Published September 30, 2024
Last update September 30, 2024
View on NVD All CVEs

CVSS base score

5.4/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

What the vulnerability does

01Description

Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. An attacker with a CVAT account may retrieve certain information about any project, task, job or membership resource on the CVAT instance. The information exposed in this way is the same as the information returned on a GET request to the resource. In addition, the attacker can also alter the default source and target storage associated with any project or task. Upgrade to CVAT 2.19.1 or any later version to fix the issue.

Key dates

02Disclosure timeline

September 30, 2024 CVE published
September 30, 2024 Record updated