Auth bypass in Cvat Computer Vision Annotation Tool
CVE-2024-45393
Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. An attacker with a CVAT account can access webhook delivery information for any webhook registered on the CVAT instance, including that of other users. For each delivery, this contains information about the event that caused the delivery, typically including full details about the object on which an action was performed (such as the task for an "update:task" event), and the user who performed the action. In addition, the attacker can redeliver any past delivery of any webhook, and trigger a ping event for any webhook. Upgrade to CVAT 2.18.0 or any later version.
Vulnerability class: Broken Access Control
EPSS: 0.002 (15.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N.
Affected products
- Cvat Computer_vision_annotation_tool
- Cvat-ai Cvat — versions >= 2.3.0, < 2.18.0
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Patch, Vendor Advisory)
- security-advisories@github.com (Patch, x_refsource_MISC)
Frequently asked questions
- What is CVE-2024-45393?
- CVE-2024-45393 is a medium-severity vulnerability in Cvat Computer Vision Annotation Tool, classified under Missing Authorization. CVSS score: 6.4/10. Published 2024-09-10.
- How severe is CVE-2024-45393?
- Medium severity. CVSS v3 base score is 6.4 out of 10.