CVE-2024-47063— Computer Vision Annotation Tool 跨站脚本漏洞

Computer Vision Annotation Tool (CVAT) contains a stored XSS via the quality report data endpoint

Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. If a malicious CVAT user with permissions to either create a task, or edit an existing task can trick another logged-in user into visiting a maliciously-constructed URL, they can initiate any API calls on that user's behalf. This gives the attacker temporary access to all data that the victim user has access to. Upgrade to CVAT 2.19.0 or a later version to fix this issue.

N/A

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

Computer Vision Annotation Tool 跨站脚本漏洞

Computer Vision Annotation Tool（CVAT）是cvat.ai开源的一种用于计算机视觉的交互式视频和图像注释工具。 Computer Vision Annotation Tool(CVAT) 2.4.7版本至2.18.0版本存在跨站脚本漏洞，该漏洞源于如果具有创建任务或编辑现有任务权限的恶意用户可以诱骗其他登录用户访问恶意构建的URL，他们就可以代表该用户发起任何API调用。

N/A

N/A