Critical severity · published Aug 1, 2022
CVE-2022-31188
Server-Side Request Forgery Vulnerability in Computer Vision Annotation Tool (CVAT)
9.8
CVSS
48.2%
EPSS
No
On KEV
Description
CVAT is an opensource interactive video and image annotation tool for computer vision. Versions prior to 2.0.0 were found to be subject to a Server-side request forgery (SSRF) vulnerability. Validation has been added to urls used in the affected code path in version 2.0.0. Users are advised to upgrade. There are no known workarounds for this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)48.2% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CV
cvat · cvat-ai
< 2.0.0 · source: vendor
CV
Computer Vision Annotation Tool · Cvat
before 2.0.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-31188
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-31188
Exploit
http://packetstormsecurity.com/files/169814/CVAT-2.0-Server-Side-Request-Forgery.html
Patch
https://github.com/cvat-ai/cvat/commit/6fad1764efd922d99dbcda28c4ee72d071aa5a07
Patch
https://github.com/cvat-ai/cvat/security/advisories/GHSA-7vpj-j5xv-29pr
More from cvat
8.5
CVE-2026-73220
CVAT: Stored XSS via annotation guides in audio tasks
8.5
CVE-2026-65986
CVAT has stored XSS via annotation guide assets
8.5
CVE-2026-44369
CVAT: Stored XSS via annotation guides
7.1
CVE-2026-47682
CVAT: Missing path-containment validation in multiple entry points allows arbitrary path writes
6.4
CVE-2024-45393
Computer Vision Annotation Tool (CVAT) is missing authorization for endpoints related to webhook deliveries