GHSA-P59W-9GQW-WJ8R Label Studio SSRF on Import Bypassing `SSRF_PROTECTION_ENABLED` Protections

Introduction This write-up describes a vulnerability found in Label Studio, a popular open source data labeling tool. The vulnerability affects all versions of Label Studio prior to 1.11.0 and was tested on version 1.8.2. Overview Label Studio's SSRF protections that can be enabled by setting the...

Label Studio SSRF on Import Bypassing `SSRF_PROTECTION_ENABLED` Protections

Introduction This write-up describes a vulnerability found in Label Studio, a popular open source data labeling tool. The vulnerability affects all versions of Label Studio prior to 1.11.0 and was tested on version 1.8.2. Overview Label Studio's SSRF protections that can be enabled by setting the...

dataops-toolkits (>=0.1.1, <=0.1.2) potentially affected by CVE-2023-47116 via label-studio (1.5.0)

label-studio PYPI version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on label-studio and may be impacted: - dataops-toolkits =0.1.1, =0.1.2 Source cves: CVE-2023-47116 Source advisory: OSV:GHSA-P59W-9GQW-WJ8R...

dataops-toolkits (>=0.1.1, <=0.1.2) potentially affected by CVE-2023-47116 via label-studio (1.5.0)

label-studio PYPI version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on label-studio and may be impacted: - dataops-toolkits =0.1.1, =0.1.2 Source cves: CVE-2023-47116 Source advisory: GHSA-P59W-9GQW-WJ8R...

hc-nlp (>=0.1.0, <=0.2.0) potentially affected by CVE-2023-47116 via label-studio (0.8.1)

label-studio PYPI version 0.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on label-studio and may be impacted: - hc-nlp =0.1.0, =0.2.0 Source cves: CVE-2023-47116 Source advisory: OSV:GHSA-P59W-9GQW-WJ8R...

CVE-2023-47116

Label Studio is a popular open source data labeling tool. The vulnerability affects all versions of Label Studio prior to 1.11.0 and was tested on version 1.8.2. Label Studio's SSRF protections that can be enabled by setting the SSRFPROTECTIONENABLED environment variable can be bypassed to access...

PYSEC-2024-127

Label Studio is a popular open source data labeling tool. The vulnerability affects all versions of Label Studio prior to 1.11.0 and was tested on version 1.8.2. Label Studio's SSRF protections that can be enabled by setting the SSRFPROTECTIONENABLED environment variable can be bypassed to access...

PYSEC-2024-127

Label Studio is a popular open source data labeling tool. The vulnerability affects all versions of Label Studio prior to 1.11.0 and was tested on version 1.8.2. Label Studio's SSRF protections that can be enabled by setting the SSRFPROTECTIONENABLED environment variable can be bypassed to access...

Server side request forgery (ssrf)

Label Studio is a popular open source data labeling tool. The vulnerability affects all versions of Label Studio prior to 1.11.0 and was tested on version 1.8.2. Label Studio's SSRF protections that can be enabled by setting the SSRFPROTECTIONENABLED environment variable can be bypassed to access...

hc-nlp (>=0.1.0, <=0.2.0) potentially affected by CVE-2023-47116 via label-studio (0.8.1)

label-studio PYPI version 0.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on label-studio and may be impacted: - hc-nlp =0.1.0, =0.2.0 Source cves: CVE-2023-47116 Source advisory: OSV:PYSEC-2024-127...

dataops-toolkits (>=0.1.1, <=0.1.2) potentially affected by CVE-2023-47116 via label-studio (1.5.0)

label-studio PYPI version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on label-studio and may be impacted: - dataops-toolkits =0.1.1, =0.1.2 Source cves: CVE-2023-47116 Source advisory: OSV:PYSEC-2024-127...

CVE-2023-47116 Label Studio SSRF on Import Bypassing `SSRF_PROTECTION_ENABLED` Protections

Label Studio is a popular open source data labeling tool. The vulnerability affects all versions of Label Studio prior to 1.11.0 and was tested on version 1.8.2. Label Studio's SSRF protections that can be enabled by setting the SSRFPROTECTIONENABLED environment variable can be bypassed to access...

CVE-2023-47116 Label Studio SSRF on Import Bypassing `SSRF_PROTECTION_ENABLED` Protections

Label Studio is a popular open source data labeling tool. The vulnerability affects all versions of Label Studio prior to 1.11.0 and was tested on version 1.8.2. Label Studio's SSRF protections that can be enabled by setting the SSRFPROTECTIONENABLED environment variable can be bypassed to access...

CVE-2023-47116

Label Studio is a popular open source data labeling tool. The vulnerability affects all versions of Label Studio prior to 1.11.0 and was tested on version 1.8.2. Label Studio's SSRF protections that can be enabled by setting the "SSRFPROTECTIONENABLED" environment variable can be bypassed to acce...

CVE-2023-47116 Label Studio SSRF on Import Bypassing `SSRF_PROTECTION_ENABLED` Protections

Label Studio is a popular open source data labeling tool. The vulnerability affects all versions of Label Studio prior to 1.11.0 and was tested on version 1.8.2. Label Studio's SSRF protections that can be enabled by setting the SSRFPROTECTIONENABLED environment variable can be bypassed to access...

CVE-2023-47116

Summary: CVE-2023-47116 affects Label Studio versions before 1.11.0 (tested on 1.8.2). The SSRF protection that is enabled via SSRF_PROTECTION_ENABLED can be bypassed because SSRF validation only checks a single DNS lookup before the request, and does not validate the final destination IP, allowi...

dataops-toolkits (>=0.1.1, <=0.1.2), hc-nlp (>=0.1.0, <=0.2.0) potentially affected by CVE-2023-47116 via label-studio (>=0.8.1, <=1.5.0)

label-studio PYPI version =0.8.1, =0.1.1, =0.1.0, =0.2.0 Source cves: CVE-2023-47116 Source advisory: MEND:CVE-2023-47116...

CVE-2023-47116: Server-Side Request Forgery (SSRF)

Label Studio is a popular open source data labeling tool. The vulnerability affects all versions of Label Studio prior to 1.11.0 and was tested on version 1.8.2. Label Studio's SSRF protections that can be enabled by setting the SSRFPROTECTIONENABLED environment variable can be bypassed to access...

PT-2024-13408

Name of the Vulnerable Software and Affected Versions Label Studio versions prior to 1.11.0 Description The issue affects Label Studio's SSRF protections, which can be bypassed to access internal web servers. This is because the current SSRF validation is done by executing a single DNS lookup to...

Label Studio 代码问题漏洞

Label Studio is an open source data labeling tool from Heartex Open Source. Allows you to use a simple and clear UI mark audio, text, images, video and time series and other data types , and exported to a variety of model formats . A code issue vulnerability exists in Label Studio versions prior ...