CVE-2022-36551
MediumCVSS 6.5Exploitation Probability (EPSS)
Very high risk91th percentile - higher than 91% of all known CVEs
Summary
An SSRF vulnerability in the Data Import module of Heartex Label Studio Community Edition versions 1.5.0 and earlier allows an authenticated user to access arbitrary files on the system. Additionally, self-registration is enabled by default, enabling a remote attacker to create an account and exploit the SSRF.
Risk Assessment
The risk involves unauthorized reading of sensitive system files by an attacker, potentially leading to data leakage or further escalation within the internal network.
Recommendation
Immediately upgrade Label Studio to a version later than 1.5.0 and disable default self-registration if not required.
Original NVD description (English source)
A Server Side Request Forgery (SSRF) in the Data Import module in Heartex - Label Studio Community Edition versions 1.5.0 and earlier allows an authenticated user to access arbitrary files on the system. Furthermore, self-registration is enabled by default in these versions of Label Studio enabling a remote attacker to create a new account and then exploit the SSRF.