PT-2024-28848 · Doccano · Doccano

Gian2Dchris · Published 2024-09-23 · Updated 2024-09-26 · CVE-2024-40441

Positive Technologies · (AI Summary)

CVSS v3.1

6.6

Medium

Base vector

AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Doccano Open source annotation tools for machine learning practitioners version 1.8.4 Doccano Auto Labeling Pipeline module to annotate a document automatically version 0.1.23

Description The issue allows a remote attacker to escalate privileges via the model attribs parameter. This can be exploited through argument manipulation, posing a risk of remote attack.

Recommendations For Doccano Open source annotation tools for machine learning practitioners version 1.8.4, urgently upgrade the affected component to mitigate the risk. For Doccano Auto Labeling Pipeline module to annotate a document automatically version 0.1.23, urgently upgrade the affected component to mitigate the risk. As a temporary workaround, consider restricting access to the model attribs parameter until a patch is available.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2024-40441

Affected Products

Doccano

References · 9

• 🔥 https://github.com/gian2dchris/CVEs/tree/main/CVE-2024-40441 · Exploit
• https://osv.dev/vulnerability/CVE-2024-40441 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-40441 · Security Note
• https://github.com/doccano/doccano/releases/tag/v1.8.4 · Note
• https://github.com/doccano/auto-labeling-pipeline/releases/tag/v0.1.23 · Note
• https://twitter.com/CVEnew/status/1838258272006021547 · Twitter Post
• https://twitter.com/oktsec/status/1838301835909599570 · Twitter Post
• https://t.me/cvedetector/6197 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1838289677972836525 · Twitter Post