MEDIUM🇵🇱 Wersja polska

CVE-2024-47064

CVSS 6.3v4.0pub. 2024-09-30upd. 2024-10-30

Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. If an attacker can trick a logged-in CVAT user into visiting a maliciously-constructed URL, they can initiate any API calls on that user's behalf. This gives the attacker temporary access to all data that the victim user has access to. Upgrade to CVAT 2.19.0 or a later version to fix this issue.

CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

  • Cvat Computer Vision Annotation Tool

    APP
    Cvat
    2.16.0 – 2.19.0 (excl.)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
XSS
CWE
References

Related vulnerabilities

CVE-2021-45046CRITICAL9.0⚠ KEVPL ✓same product

Apache Log4j: niekompletna naprawa CVE-2021-44228 — RCE przez JNDI Lookup

CVE-2026-23526HIGH8.5same product

CVAT is an open source interactive video and image annotation tool for computer vision. In versions 1.0.0 thro...

CVE-2026-23516HIGH8.6same product

CVAT is an open source interactive video and image annotation tool for computer vision. In versions 2.2.0 thro...

CVE-2025-23045HIGH8.7same product

Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. ...

CVE-2024-37164HIGH7.1same product

Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. ...