CVAT quality report data endpoint stored XSS vulnerability
CVAT versions 2.4.7 to 2.18.0 contained a stored cross-site scripting vulnerability in the quality report data endpoint that allowed malicious users to execute arbitrary API calls on behalf of other logged-in users by tricking them into visiting a maliciously-constructed URL. The vulnerability was patched in version 2.19.0.
What happened
CVAT versions 2.4.7 through 2.18.0 contained a stored cross-site scripting vulnerability in the quality report data endpoint. A malicious CVAT user with permissions to create or edit a task could trick another logged-in user into visiting a maliciously-constructed URL to initiate API calls on that user's behalf.
Reported impact
The vulnerability gave attackers temporary access to all data that the victim user had access to.
Index analysis
The vulnerability was assigned CVE-2024-47063 and CVSS v3.1 score of 7.3 (High severity). It required network access, low attack complexity, low privileges, and user interaction to exploit. The fix involved setting the content-type header to 'application/json' on the quality report data endpoint response.
Governance controls
The vulnerability was patched in CVAT version 2.19.0.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.