CVAT broken access control in PATCH endpoints (CVE-2024-47172)
CVAT, an open-source computer vision annotation tool, contained a broken access control vulnerability in PATCH endpoints that allowed authenticated attackers to view and modify project, task, job and membership resources. The issue was patched in version 2.19.1.
What happened
CVAT versions 2.0.0 through 2.19.0 contained broken access control in several PATCH endpoints affecting projects, tasks, jobs and memberships resources.
An attacker with a CVAT account could retrieve information about any project, task, job or membership resource on the CVAT instance by making PATCH requests, retrieving the same information as GET requests would return.
The attacker could also alter the default source and target storage associated with any project or task.
Reported impact
The vulnerability allowed unauthorized access to information and modification of storage settings for any resource on the CVAT instance.
Index analysis
The vulnerability was a broken access control issue (CWE-863) in authorization checks for PATCH requests, with CVSS 3.1 score of 5.4 (Moderate severity).
The attack vector was network-based, requiring low privileges and user interaction, with low impact on confidentiality and integrity.
Governance controls
CVAT patched the vulnerability in version 2.19.1 by implementing proper authorization checks for PATCH requests, including requiring view permissions and adding a new scope for storage modifications.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.