CVE-2024-37164

🗓️ 13 Jun 2024 15:52:15Reported by [email protected]Type

CVAT prior to v2.14.3 allows SSRF via intranet IP addresses or internal domain names, enabling potential access to internal servers & files

Reporter	Title	Published	Views	Family All 4
Cvelist	CVE-2024-37164 CVAT SSRF via custom cloud storage endpoints	13 Jun 202414:10	–	cvelist
OSV	CVE-2024-37164	13 Jun 202415:15	–	osv
Vulnrichment	CVE-2024-37164 CVAT SSRF via custom cloud storage endpoints	13 Jun 202414:10	–	vulnrichment
CVE	CVE-2024-37164	13 Jun 202415:15	–	cve

Nvd

Node

cvat computer_vision_annotation_toolRange2.1.0–2.14.3

Source	Link
github	www.github.com/cvat-ai/cvat/security/advisories/GHSA-q684-4jjh-83g6
github	www.github.com/cvat-ai/cvat/commit/f2346934c80bd91740f55c2788ef7d535a291d4c

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo

13 Jun 2024 15:15Current

CVSS38.5

EPSS0.00093

CWE-918

cvat ssrf intranet ip internal domain network security patch cloud storage authentication amazon s3 azure blob storage