cve.bz

CVE-2022-36551

6.5 mediumEPSS 6.9%

Medium (6.5) in heartex label studio. EPSS 6.9% chance of exploitation in the next 30 days. Fixed in label-studio 1.5.0.post0, 1.6.0.

A Server Side Request Forgery (SSRF) in the Data Import module in Heartex - Label Studio Community Edition versions 1.5.0 and earlier allows an authenticated user to access arbitrary files on the system. Furthermore, self-registration is enabled by default in these versions of Label Studio enabling a remote attacker to create a new account and then exploit the SSRF.

Severity

CVSS 3.1

6.5 medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS
6.9% chance of exploitation in the next 30 days; higher than 94% of CVEs (scores of 2026-10-31)
CWE
CWE-918
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-pc6f-259w-w3j6PyPIlabel-studio<1.6.01.6.0
PYSEC-2022-300PyPIlabel-studio<1.5.0.post01.5.0.post0

References

Check your stackJSON