CVE-2022-31188

CRITICAL
Published Aug 1, 20223y ago · Modified Jun 17, 20262w ago
9.8 CVSS 3.1
Critical
Find Similar
Published Aug 1, 2022 3y ago
Last Modified Jun 17, 2026 2w ago

Description

CVAT is an opensource interactive video and image annotation tool for computer vision. Versions prior to 2.0.0 were found to be subject to a Server-side request forgery (SSRF) vulnerability. Validation has been added to urls used in the affected code path in version 2.0.0. Users are advised to upgrade. There are no known workarounds for this issue.

CVSS Details

Base Score
9.8
Exploitability
3.9
Impact
5.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

No active exploitation signals — not in CISA KEV and no EPSS score yet.

Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-918 Server-Side Request Forgery (SSRF) Validation

Affected Products 1

VendorProductVersionRange
cvatcomputer_vision_annotation_tool* <2.0.0

References 3

  • packetstormsecurity.com http://packetstormsecurity.com/files/169814/CVAT-2.0-Server-Side-Request-Forgery.html
    ExploitThird Party AdvisoryVDB Entry
  • github.com https://github.com/cvat-ai/cvat/commit/6fad1764efd922d99dbcda28c4ee72d071aa5a07
    PatchThird Party Advisory
  • github.com https://github.com/cvat-ai/cvat/security/advisories/GHSA-7vpj-j5xv-29pr
    PatchThird Party Advisory

Remediation

  • github.com https://github.com/cvat-ai/cvat/commit/6fad1764efd922d99dbcda28c4ee72d071aa5a07
    PatchThird Party Advisory
  • github.com https://github.com/cvat-ai/cvat/security/advisories/GHSA-7vpj-j5xv-29pr
    PatchThird Party Advisory