PT-2024-28849 · Unknown+1 · Doccano Auto Labeling Pipeline+1

Gian2Dchris · Published 2024-09-23 · Updated 2024-09-26 · CVE-2024-40442

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Doccano Open source annotation tools for machine learning practitioners version 1.8.4 Doccano Auto Labeling Pipeline module version 0.1.23

Description An issue in the affected software allows a remote attacker to escalate privileges via a crafted REST Request. This issue affects the ability to annotate documents automatically and may lead to unauthorized access.

Recommendations For Doccano Open source annotation tools for machine learning practitioners version 1.8.4, consider disabling the REST API endpoint until a patch is available. For Doccano Auto Labeling Pipeline module version 0.1.23, restrict access to the automatic annotation feature to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2024-40442

Affected Products

Doccano

Doccano Auto Labeling Pipeline

References · 10

• 🔥 https://github.com/gian2dchris/CVEs/tree/main/CVE-2024-40442 · Exploit
• https://osv.dev/vulnerability/CVE-2024-40442 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-40442 · Security Note
• https://github.com/doccano/doccano/releases/tag/v1.8.4 · Note
• https://github.com/doccano/auto-labeling-pipeline/releases/tag/v0.1.23 · Note
• https://t.me/cvedetector/6196 · Telegram Post
• https://twitter.com/cracbot/status/1838820839279726727 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1838287116532392332 · Twitter Post
• https://twitter.com/CVEnew/status/1838258273373331634 · Twitter Post
• https://twitter.com/cracbot/status/1839183192403972566 · Twitter Post