CVE-2022-36551

A Server Side Request Forgery (SSRF) in the Data Import module in Heartex - Label Studio Community Edition versions 1.5.0 and earlier allows an authenticated…

published October 3, 2022

CVSS
—
EPSS
7%
Percentile
94.1
In the wild
Unconfirmed
What it is

A Server Side Request Forgery (SSRF) in the Data Import module in Heartex - Label Studio Community Edition versions 1.5.0 and earlier allows an authenticated user to access arbitrary files on the system. Furthermore, self-registration is enabled by default in these versions of Label Studio enabling a remote attacker to create a new account and then exploit the SSRF.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.06890 · 94.1th percentile
Published
2022-10-03T00:00Z
EPSS history
Timeline
  • 03 OCT 00:00Z
    A Server Side Request Forgery (SSRF) in the Data Import module in Heartex - Label Studio Community Edition versions 1.5.0 and earlier allows an authenticated…
    cvelistv5