CVE-2022-36551
Medium
Description
A Server Side Request Forgery (SSRF) in the Data Import module in Heartex - Label Studio Community Edition versions 1.5.0 and earlier allows an authenticated user to access arbitrary files on the system. Furthermore, self-registration is enabled by default in these versions of Label Studio enabling a remote attacker to create a new account and then exploit the SSRF.
SeverityMedium
CVSS6.5
Exploit probability—
ProductHeartex Label Studio
PublishedOct 3, 2022
First seenOct 3, 2022
How to fix
Update
- label-studio1.6.0, 1.5.0.post0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| heartex label_studio | v ≤ 1.5.0 | — |
| label-studioPyPI | v < 1.6.0, v < 1.5.0.post0 | 1.6.0, 1.5.0.post0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.