CVE-2022-36551: Heartex - Label Studio Community Edition vulnerable to SSRF in the Data Import module
(updated )
A Server Side Request Forgery (SSRF) in the Data Import module in Heartex - Label Studio Community Edition versions 1.5.0 and earlier allows an authenticated user to access arbitrary files on the system. Furthermore, self-registration is enabled by default in these versions of Label Studio enabling a remote attacker to create a new account and then exploit the SSRF. This issue is fixed in version 1.6.0.
References
- github.com/advisories/GHSA-pc6f-259w-w3j6
- github.com/heartexlabs/label-studio
- github.com/heartexlabs/label-studio/commit/501142cb815ac964b0c600c491885b67386870c2
- github.com/heartexlabs/label-studio/pull/2840
- github.com/heartexlabs/label-studio/releases/tag/1.6.0
- github.com/pypa/advisory-database/tree/main/vulns/label-studio/PYSEC-2022-300.yaml
- nvd.nist.gov/vuln/detail/CVE-2022-36551
Code Behaviors & Features
Detect and mitigate CVE-2022-36551 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →