CVE-2024-23633

🗓️ 23 Jan 2024 23:15:09Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 79 Views🌐 WEB

Label Studio had a remote import feature allowing download of files from a remote web source, prior to v1.10.1, enabling execution of malicious JavaScript code

Reporter	Title	Published	Views	Family All 15
Circl	CVE-2024-23633	23 Jan 202422:28	–	circl
CNNVD	Label Studio Cross-Site Scripting Vulnerability	23 Jan 202400:00	–	cnnvd
Cvelist	CVE-2024-23633 Label Studio XSS Vulnerability on Data Import	23 Jan 202423:15	–	cvelist
EUVD	EUVD-2024-0084	3 Oct 202520:07	–	euvd
Github Security Blog	Cross-site Scripting Vulnerability on Data Import	24 Jan 202414:21	–	github
NVD	CVE-2024-23633	24 Jan 202400:15	–	nvd
OSV	CVE-2024-23633 Label Studio XSS Vulnerability on Data Import	23 Jan 202423:15	–	osv
OSV	GHSA-FQ23-G58M-799R Cross-site Scripting Vulnerability on Data Import	24 Jan 202414:21	–	osv
OSV	PYSEC-2024-128	24 Jan 202400:15	–	osv
Prion	Server side request forgery (ssrf)	24 Jan 202400:15	–	prion

NVD

Vulners

Node

humansignal label_studioRange<1.10.1

[
  {
    "vendor": "HumanSignal",
    "product": "label-studio",
    "versions": [
      {
        "version": "< 1.10.1",
        "status": "affected"
      }
    ]
  }
]

Source	Link
developer	www.developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/sandbox
github	www.github.com/HumanSignal/label-studio/blob/1.9.2.post0/label_studio/data_import/api.py
github	www.github.com/HumanSignal/label-studio/blob/1.9.2.post0/label_studio/data_import/uploader.py
github	www.github.com/HumanSignal/label-studio/security/advisories/GHSA-fq23-g58m-799r

Parameter	Position	Path	Description	CWE
ids	query param	/api/projects/{project_id}/file-uploads?ids=[{download_id}]	Endpoint used to retrieve the path of a downloaded file, which could expose HTML/JS content via Content-Type based on file extension, enabling XSS when a crafted HTML file is viewed.	CWE-79

21 Nov 2024 08:58Current

6.3Medium risk

Vulners AI Score6.3

CVSS 3.14.7 - 6.1

EPSS0.00145

SSVC

CWE-79