PT-2024-31597 · Unknown · Computer Vision Annotation Tool

Speclad · Published 2024-09-10 · Updated 2025-01-21 · CVE-2024-45393

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Computer Vision Annotation Tool (CVAT) versions prior to 2.18.0

Description The Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. An attacker with a CVAT account can access webhook delivery information for any webhook registered on the CVAT instance, including that of other users. For each delivery, this contains information about the event that caused the delivery, typically including full details about the object on which an action was performed, and the user who performed the action. In addition, the attacker can redeliver any past delivery of any webhook, and trigger a ping event for any webhook.

Recommendations Upgrade to CVAT 2.18.0 or any later version.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2024-45393

GHSA-P3C9-M7JR-JXXJ

Affected Products

Computer Vision Annotation Tool

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/45xxx/CVE-2024-45393.json · Exploit
• https://github.com/cvat-ai/cvat/commit/0fafb797fdf022fb83ce81c6405ba19b583a236f · Patch
• https://github.com/cvat-ai/cvat/security/advisories/GHSA-p3c9-m7jr-jxxj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-45393 · Security Note
• https://osv.dev/vulnerability/CVE-2024-45393 · Vendor Advisory
• https://t.me/cvenotify/107994 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1833554217224552680 · Twitter Post
• https://twitter.com/CVEnew/status/1833549068762812704 · Twitter Post
• https://t.me/cvedetector/5238 · Telegram Post