CVE-2023-47116: fallo de gravedad media en HumanSignal label-studio
Label Studio SSRF on Import Bypassing `SSRF_PROTECTION_ENABLED` Protections
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.3epss 0.7%
Label Studio is a popular open source data labeling tool. The vulnerability affects all versions of Label Studio prior to 1.11.0 and was tested on version 1.8.2. Label Studio's SSRF protections that can be enabled by setting the `SSRF_PROTECTION_ENABLED` environment variable can be bypassed to access internal web servers. This is because the current SSRF validation is done by executing a single DNS lookup to verify that the IP address is not in an excluded subnet range. This protection can be bypassed by either using HTTP redirection or performing a DNS rebinding attack.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Productos afectados
HumanSignal · label-studioCVEs relacionadas — HumanSignal label-studio
En el mismo producto, de las más peligrosas a las menos.
CVE-2023-47117HIGHObject Relational Mapper Leak Vulnerability in Filtering Task in Label StudioEPSS 4.1%CVE-2024-26152MEDIUMLabel Studio vulnerable to Cross-site Scripting if `<Choices>` or `<Labels>` are used in labeling config EPSS 2.2%CVE-2025-25296MEDIUMLabel Studio allows Cross-Site Scripting (XSS) via GET request to `/projects/upload-example` endpointEPSS 1.9%CVE-2023-47115HIGHLabel Studio XSS Vulnerability on Avatar UploadEPSS 1.4%CVE-2023-43791CRITICALLabel Studio has Hardcoded Django `SECRET_KEY` that can be Abused to Forge Session TokensEPSS 1.2%CVE-2025-25295HIGHLabel Studio has a Path Traversal Vulnerability via image FieldEPSS 0.8%