CVE-2023-43791
Critical
Description
Label Studio is a multi-type data labeling and annotation tool with standardized output format. There is a vulnerability that can be chained within the ORM Leak vulnerability to impersonate any account on Label Studio. An attacker could exploit these vulnerabilities to escalate their privileges from a low privilege user to a Django Super Administrator user. The vulnerability was found to affect versions before `1.8.2`, where a patch was introduced.
SeverityCritical
CVSS9.8
Exploit probability—
ProductHumansignal Label Studio
PublishedNov 9, 2023
First seenNov 9, 2023
Weakness typeCWE-200Sensitive information exposure
How to fix
Update
- humansignal label_studio1.8.2 or later
- label-studio1.8.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| humansignal label_studio | v < 1.8.2 | 1.8.2 |
| label-studioPyPI | v < 1.8.2 | 1.8.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.