CVE-2024-47064

CVSS V2 None CVSS V3 None

Description

Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. If an attacker can trick a logged-in CVAT user into visiting a maliciously-constructed URL, they can initiate any API calls on that user's behalf. This gives the attacker temporary access to all data that the victim user has access to. Upgrade to CVAT 2.19.0 or a later version to fix this issue.

Overview

CVE ID
CVE-2024-47064

Assigner
GitHub_M

Vulnerability Status
PUBLISHED

Published Version
2024-09-30T14:57:12.805Z

Last Modified Date
2024-09-30T16:26:35.340Z

Weakness Enumerations

CWE	URL
CWE-79	http://cwe.mitre.org/data/definitions/79.html
CWE-81	http://cwe.mitre.org/data/definitions/81.html

References

Reference URL	Reference Tags
https://github.com/cvat-ai/cvat/security/advisories/GHSA-hp6c-f34j-qjj7	x_refsource_CONFIRM
https://github.com/cvat-ai/cvat/commit/0bf45fd5de08a652dffbfb517318a64c2fdbc5cf	x_refsource_MISC

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2024-47064
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47064

History

Created	Old Value	New Value	Data Type	Notes
2024-10-06 19:59:59				Added to TrackCVE