CVE-2022-31188: cvat computer vision annotation tool

csirt@kutim:~/threat-intel/cve/CVE-2022-31188

CVSS 9.8 · Critical EPSS 48,6%

Kerentanan Server-Side Request Forgery (SSRF) pada cvat computer vision annotation tool. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

CVAT is an opensource interactive video and image annotation tool for computer vision. Versions prior to 2.0.0 were found to be subject to a Server-side request forgery (SSRF) vulnerability. Validation has been added to urls used in the affected code path in version 2.0.0. Users are advised to upgrade. There are no known workarounds for this issue.

Rincian

Terbit di NVD: 1 Agustus 2022
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-918: Server-Side Request Forgery (SSRF)
EPSS (30 hari): 48,6% peluang dieksploitasi; lebih tinggi dari 98,8% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
cvat	computer vision annotation tool	Semua versi sebelum 2.0.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/cvat-ai/cvat/commit/6fad1764efd922d99dbcda28c4ee72d071aa5a07 patch · advisory pihak ketiga
https://github.com/cvat-ai/cvat/security/advisories/GHSA-7vpj-j5xv-29pr patch · advisory pihak ketiga
http://packetstormsecurity.com/files/169814/CVAT-2.0-Server-Side-Request-Forgery.html exploit · advisory pihak ketiga · vdb entry

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.