PT-2025-23240 · Cvat · Cvat

Speclad · Published 2025-05-30 · Updated 2025-10-15 · CVE-2025-48381

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Computer Vision Annotation Tool (CVAT) versions 2.4.0 through 2.37.x

Description The issue allows an authenticated user to retrieve sensitive information, including IDs and names of tasks, projects, labels, and IDs of jobs and quality reports, from a CVAT instance. This can lead to a denial of service if the instance contains a large number of resources, as retrieving this information may consume system resources and deny access to legitimate users.

Recommendations For versions 2.4.0 through 2.37.x, update to version 2.38.0 to resolve the issue.

Exploit

Fix

Weakness Enumeration

CWE-201

Related Identifiers

CVE-2025-48381

GHSA-7484-2GFM-852P

Affected Products

Cvat

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48381.json · Exploit
• https://github.com/cvat-ai/cvat/security/advisories/GHSA-7484-2gfm-852p · Vendor Advisory
• https://github.com/cvat-ai/cvat/commit/7136c99fb2c3a5cb2d8c3ca54b4201b9fa6aab5a · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-48381 · Security Note
• https://osv.dev/vulnerability/CVE-2025-48381 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1928310942812508177 · Twitter Post
• https://twitter.com/CVEnew/status/1928308221720076595 · Twitter Post
• https://t.me/cveNotify/138866 · Telegram Post
• https://t.me/cvenotify/124095 · Telegram Post
• https://t.me/cvetracker/24962 · Telegram Post