CVE-2023-43791criticalCWE-200

CVE-2023-43791: falha crítica em HumanSignal label-studio

Label Studio has Hardcoded Django `SECRET_KEY` that can be Abused to Forge Session Tokens

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar label-studio+ Monitorar label-studio

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.8epss 1.2%
Label Studio is a multi-type data labeling and annotation tool with standardized output format. There is a vulnerability that can be chained within the ORM Leak vulnerability to impersonate any account on Label Studio. An attacker could exploit these vulnerabilities to escalate their privileges from a low privilege user to a Django Super Administrator user. The vulnerability was found to affect versions before `1.8.2`, where a patch was introduced.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
HumanSignal · label-studio
CVEs relacionadas — HumanSignal label-studio

No mesmo produto, das mais perigosas para as menos.

CVE-2023-47117HIGHObject Relational Mapper Leak Vulnerability in Filtering Task in Label StudioEPSS 4.1%CVE-2024-26152MEDIUMLabel Studio vulnerable to Cross-site Scripting if `<Choices>` or `<Labels>` are used in labeling config EPSS 2.2%CVE-2025-25296MEDIUMLabel Studio allows Cross-Site Scripting (XSS) via GET request to `/projects/upload-example` endpointEPSS 1.9%CVE-2023-47115HIGHLabel Studio XSS Vulnerability on Avatar UploadEPSS 1.4%CVE-2025-25295HIGHLabel Studio has a Path Traversal Vulnerability via image FieldEPSS 0.8%CVE-2023-47116MEDIUMLabel Studio SSRF on Import Bypassing `SSRF_PROTECTION_ENABLED` ProtectionsEPSS 0.7%